Extracted

• • Target

    rocee6632.exe

  • Size

    264KB

  • MD5

    49490781256eb385d2331df5a69dc140

  • SHA1

    8d4c961f6c10bda804b5d29923f937848f0c6915

  • SHA256

    541e5e1932882d5833cbc39c7ab81d4faeba4a9fe4b915530be3533d0269cc99

  • SHA512

    8bccf328813842e72688295438b38e080ffc2a8b39ac2349c29611616398f2aa2e3832ce7ca6368bea5b2d5890f5d598906bcf1e95d8dc89e3dd48fee3d69c6a

  • SSDEEP

    6144:/Ya6+/+2b3/J5PMIId8xUCpdlHcrm4WqmxHppCXk:/YonnW8ye7HOm3qmxJpCXk

  Score

  10^/10

  formbookre29ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2