Extracted

• • Target

    Quotation.com

  • Size

    1.2MB

  • MD5

    ca3395b17a2f8092f2f5054a06eccbee

  • SHA1

    bbcec44150facad7ee24c6c69329456fdd4cb011

  • SHA256

    a35a739a11186937e37899ee065f6c1832f27ec88a182079f7a8f2d57884184b

  • SHA512

    738c278d8cab458fb60e93433cd4e78799898602bdb24694f2e49ee17df6c1e2c0a56697ef4e9cfda12a03a895504176e6f9c1312c0272a7937e65877acb7e48

  Score

  10^/10

  babadedaformbookvnscrypterloaderpersistenceratspywarestealertrojan

  • Babadeda

    Babadeda is a crypter delivered as a legitimate installer and used to drop other malware families.

    loadercrypterbabadeda

  • Babadeda Crypter

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook Payload

    rat

  • Adds policy Run key to start application

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2