Extracted

• • Target

    SecuriteInfo.com.Win64.Evo-gen.8877.18401.exe

  • Size

    448KB

  • MD5

    19570ae7d752c7f688b833193352a7cb

  • SHA1

    c5b129ea601cd6b1bb2d3fbd3b597ed434ed70af

  • SHA256

    6eec1a8da601b90f81fdb28221702581d5a1698201976958fb160b2d956edb19

  • SHA512

    1cfa750a02c23bf3b9d2545033a210d2bbfc3947b472be62e485d09f683f864acc146e6b3af880d46150bd77fae17285ed0be1420540e7674e4b4c0d9a439c5a

  • SSDEEP

    12288:cYEsiw+tb/EPYxNdaGJd4t6O59rxjDqIwjOS5tKl6Nz3OFTj:1ElXtLDgGct7pRwjR5El6NTOB

  Score

  10^/10

  formbookcodppersistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Sets service image path in registry

    persistence

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2