Extracted

• • Target
    QUOTES~0.EXE.exe
  • Size 399KB
  • SHA256 4873abac800f1c2594fdf8802b84ecfbdb7e704c0d46ff5edf66f46ec7a692e7
  • MD5 f15b261228ef2d9060730543739abd09
  • SHA1 0d6273e8c20f9521df80b8dd5b22252bdf554a86
  • SHA512 060743635bd4487dd6732a261ef0a09dfcaae3d7908013b2a39b60b555410ad557adfd6288e883c7c49da3765ffe7f5751f3bfe4e924a72779a8b19ed4eb75ff
  • SSDEEP 6144:IYa6vkDt/cnsThphI8z/F6zFaIWZ94pmVC+GHfgz4:IY1kDt/hiBa994cHGHI0
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookrs11ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2