Extracted

• • Target

    c352208b986b71d83fdc059413c236f0.exe

  • Size

    215KB

  • MD5

    c352208b986b71d83fdc059413c236f0

  • SHA1

    24e6775ed6e4beb4235cc0604d6627a055aefbc1

  • SHA256

    cbce721b186a5ebb1a2c51249571d8021cc67c019a0cfbc0cef73fd1de48708e

  • SHA512

    0928857e3fcc4addb2787a9bc2ff99f1287e5e8d958d180adf6cb6c619571b54e551e51d1668aa68e3eda1beb3b887dd95b3a4dbad2d933d25d100db8370521a

  • SSDEEP

    6144:qweEpws+7aOJr52ZvqBHtT69I83TEKX6eorwr:bwz71FIAB83TGeoMr

  Score

  10^/10

  formbookb47hpersistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2