Extracted

• • Target
    Dekont.exe
  • Size 262KB
  • SHA256 4061f4ecc5f9ea83a7f8f3c084b3999dae002d26c1dc62d7ddecd2c5f21a26c2
  • MD5 a90745e8fc878a0aedc37a7ec55a67bb
  • SHA1 26b0e6828b24e6be84d8ea52ffcf5220d0e5af93
  • SHA512 2c1722ed87a6bf1e98abe8f7611b6e880ae337cb351d8d6a41b6f7c184dfa7cc3b361e66fde5b81f8bd1ebf4799fc484dca628e9db986b253a9559a3fdbc60d8
  • SSDEEP 6144:/Ya6xjsGsbBWU+gDLRHyS8r28jkU3hA/cVF/B8wAF+Bo:/YL2YgD9SS8r28wylF/B8/5
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookmh04ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Deletes itself

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2