Extracted

• • Target

    PRE ALERT NOTICE.exe

  • Size

    352KB

  • MD5

    69c2be41eea373b5fd86c88464868064

  • SHA1

    af52386882ee00e91425ebce6fb409b36cd49d2c

  • SHA256

    ec9d091c881ad4da6f5e77f947c2723b1aa374fbf373931871c767dfb9cabb0e

  • SHA512

    b5fe4d6fb8276552a1c16b2ec94341e549401a71645d7ab26b53dc63e20de7201cfa28ab543459951a8f50c2049974533c82083c95c353b1e9ac4ceed41fbbc4

  • SSDEEP

    6144:vYa6cmu5R3tS1ZmDoPfLLw6gCeF00DxKzMu+GAPgnYyXy8eBkoxG+o3V6kfm:vYSz5eZmMPfLhEFBszj+GAPeLi8e+6qm

  Score

  10^/10

  formbooks28ypersistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Deletes itself

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2