Extracted

• • Target
    nr. comandă 5600885643.exe
  • Size 591KB
  • SHA256 6b7204b9938cdc7e24b589faac4e12ed848c7121269899614b38bc95784845b9
  • MD5 baccd459f7f491fdaf2aeb16980eee82
  • SHA1 b28d071e71456898edf8f77afeb3cf1ec0d3d289
  • SHA512 08559c66282d772416d66950f319ad4f433daa6bdcef82ec5b907763c0eaddf36382e6e30fd243660f443dea70e82cc6cc06ecb3b3e63fa4bde9f22edc576af7
  • SSDEEP 12288:QRMJjXiDVXJtGuTsi7nw+6A1kkWTe08gjxMi:QSoC4Z7nw+6KHgjxM
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookzs84persistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Sets service image path in registry

    persistence

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2