Extracted

• • Target
    odeme.exe
  • Size 270KB
  • SHA256 cc2ffcb49e5ff1b4f1be2c0c8f5bef3cf51caeef5fcd8be8a6367174b7dd8063
  • MD5 b95ec05e5039e9d85a18eca4985f50f1
  • SHA1 50c4dd7c8b27213e7d74f59d16ba3c0e7c0fbe5a
  • SHA512 977b6ebf6ed62ffdfc8f3f18700ce0704cb5cebe57c518a39dad89927a425e6625c81d1d0063d2adda905ec627fe10558e9d96f2444ae0858ad81e5cce84cf29
  • SSDEEP 6144:/Ya6paAZMh/mnoevZmAt/VxJqpO7Mae2i6Nmn4LnyNfhBHXovJsYo2Z1:/YbaAZMFmn9xmAtNXqM7Mae2TjnylH3A
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookme29ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Blocklisted process makes network request

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2