Extracted

• • Target
    payment document.exe
  • Size 95KB
  • SHA256 448d2ecff6d2b8cf7a5da39c4be57e4bb991fcf35a1a6bfbe24f0430684fc59c
  • MD5 50f9cf33552796c0935796d448df1ca3
  • SHA1 add69b499988d6a56b6a988387bdb6ae017dd1e2
  • SHA512 13c29f59336caba962af5781882bbc69da7f769670974af2f1a5ef929a8410f40e5901add5bbdfe896eedf26f0d73fd36e91e8af5521aae0b2d464d159727803
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookevasionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Turns off Windows Defender SpyNet reporting

    evasion

  • Windows security bypass

    evasiontrojan

  • Formbook Payload

    rat

  • Deletes itself

  • Windows security modification

    evasiontrojan

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2