Extracted

• • Target
    COVID FORM1.exe
  • Size 440KB
  • SHA256 bc09ecf5cb6364f4d053ec0420282fa6e7a1649a8a5ca2af2ca933aa27f8b90c
  • MD5 ba0522ceb915a084ac7b8f3e7d8868c6
  • SHA1 39764b91316a1fa172c7b5db9e4f6e58dacec306
  • SHA512 98fe103661ce1013f57e7f8ed410e5147148c74a9d206927751cd9a299972572485d829378a89bc11d3e18994190b234b3a29bbb683387e092ed305d6b89b3a1
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookb3n1ratspywarestealertrojanpersistence

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook Payload

    rat

  • Sets service image path in registry

    persistence

  • Deletes itself

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2