Extracted

• • Target
    6e8215eee3034d6dcf18d79d397e5715.exe
  • Size 1.2MB
  • SHA256 ac4761c259daede4b4efb78816c98fb56344e381bb56d69ea897c30c9899bf39
  • MD5 6e8215eee3034d6dcf18d79d397e5715
  • SHA1 5612bff0830a9a025eb35cf7c054d2062745d1b9
  • SHA512 5b5a08e02c7f58f25a436508848f90d397c2545b474f37202cef5f8ba9d4924761e500a2d54e082f51eabd80b2cc33d21d73b45206d79e64c7bb0ce21abf83c1
  • SSDEEP 24576:ZQ3IGHgEKN05uKEPfbze1J9c8ae1D1FkTaO/bwntZKo4PCnsoO+Lt:ZQ3IbGEf+X9Xtk2O/bw7KpCnsa5
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookrs10ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Loads dropped DLL

  • Drops file in System32 directory

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2