Extracted

• • Target
    HXM030~0.EXE.exe
  • Size 296KB
  • SHA256 8770f9d32f3b5b26267d6320c355f576df3d09e49d58e50ac16d044f4cf2cf54
  • MD5 56c21a2796f5c5bdf12603e3e18f59d4
  • SHA1 31e7a1dd4e1d981a07d0006254cdafd7ca0c1c23
  • SHA512 a754abc5b3d5e4a1a9cbb59b55592988380cd0fc4df61f869b6d123c2173e9a19b6bb18eee61902cc19d09da5a88435c0f36a5f66477100688000bcded36028b
  • SSDEEP 6144:nYa6FM+2pDlj3uGJpZrJ52Gp0yK0Iqbu2Cz99Dzr2Oc3:nY4+21lruApZNP0yXI6u2CzPeOu
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookrs11persistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Blocklisted process makes network request

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2