Extracted

• • Target
    PO NO#6910009.exe
  • Size 258KB
  • SHA256 e2f2df406e05d13e2245e2fe9da7128c257a7bb11464dce77ce386b51470abd8
  • MD5 9bd749c7511ddd96b428c50f5023c81d
  • SHA1 985905d7d30d8e4dc9e627622fd1527ae228d825
  • SHA512 b13dda3d5ed399ec3d7d8b11be4b06e71b3e3ddafced126615bf49eefaf517fb77c6df5e6bcc3ae5f7627e8bf9021c552cba8eff0a9f4596cff09814d88241f6
  • SSDEEP 3072:ibG7N2kDTHUpouSbFRnXYAXwe1LM8ZRyWjfkV0BSGzgjVi4OOKLEKgvaKd1IpLL0:ibE/HUkPbweZvTE0B9zEjvaKj+4QIbWS
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbooksy01ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Blocklisted process makes network request

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2