Extracted

• • Target
    rcx41011_exe
  • Size 241KB
  • SHA256 438f095538e09af9bbed2379f8cfd673847dc00df4bc8ff3b47f4cb3645bf966
  • MD5 177790b0d54c9a6d59bf281037046be4
  • SHA1 fb7d19f73d5d2a56679bfbbfa32307b198cd5dd1
  • SHA512 ec7f573d074961522905af27b96f60ce7745bd7480f0cad02f1861391f884fb128cc1c665f6ba114ac76234567d1a0f2a12765e40212a9081c2366afdeac40a7
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookransomwareratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook Payload

    rat

  • Deletes itself

  • Loads dropped DLL

  • Enumerates physical storage devices

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    ransomware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2