Extracted

• • Target

    ET2321000550.exe

  • Size

    338KB

  • MD5

    d4ca2be4fd05ff8e64a606443144b0ee

  • SHA1

    99070557e40ee161ec1468ae147f601e1073994d

  • SHA256

    731884023aba6003836d2d19d064cb991b9e9cfe3c494fdb708ad30d32c4857b

  • SHA512

    ae782f37a2b39c3f86b83cdcf423e954627567b0aa163666014cee30b8ef08f5f5828806d7e31cfa09f0e4e08dcf7d90e6b053d19a7e8238c1e5db4715aa7e2b

  • SSDEEP

    6144:BnPdudwDsdEB9hw1R8pxWtNoYKGGzlBELCuwprGu+x6YxBCrmDcIPieyZApSvpaZ:BnPdwdAhwXhtNoYKGGhBELhwQX6DAKel

  Score

  10^/10

  formbookge58persistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2