Extracted

• • Target
    SecuriteInfo.com.BehavesLike.Win32.Fareit.gc.4989
  • Size 472KB
  • SHA256 ff12520da32ca8d2478c1bdfbdbe7e057d3d6f079d81ceb2fc86c539889e1280
  • MD5 622972f8ebfbe821dc3427dd09308a7c
  • SHA1 a418361a7ae8f2aa3312fc344d178e8a0ee6e72f
  • SHA512 fb4a22d6b120e4b240762b0b064180fe623a659a0e35a0a88d3fce2c9f4953433440fe741cb03a7826c90daf8fe14e8e8195597e78e2ab663d592e64245a8724
  • MD5 SHA1 SHA512

  Score

  10^/10

  ratpersistencetrojanspywarestealerformbook

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook Payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2