Extracted

• • Target
    2fdf0daf15395bf89c3baab2efff427dd7026ba306bb5c77c5f5598f5c6eb30f
  • Size 339KB
  • SHA256 2fdf0daf15395bf89c3baab2efff427dd7026ba306bb5c77c5f5598f5c6eb30f
  • MD5 c9b0c4cb22b9f6ca2ba4e65a6ddd3f85
  • SHA1 1db3cc412c6785f5380dc3dd62d8532b6e306ef6
  • SHA512 28e7992983db2edea83b57af7e3c1848ccc46ef71db3cf1ba250eba3199cea219df2899090b175f944d7315b949fbe1e876a02690bdf607aba1788a8e9f65f74
  • SSDEEP 6144:MXbNb4ZaB+O+NY3lQopxnLxgyTDdgPy6VHBy9/17ls6oUgN:MXpQakilhKeJmEJ17l8
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookhskpersistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1