Extracted

• • Target

    151bfa7336a9c96e65bf8a0eeb54a3d34665e612c8c5b3a7886f16a6f58277c4.exe

  • Size

    562KB

  • MD5

    84144b6048277290bb6eb647bbc5ad2a

  • SHA1

    609a26e95e4b343bfb47ab51bdd68ef9a8ef791f

  • SHA256

    151bfa7336a9c96e65bf8a0eeb54a3d34665e612c8c5b3a7886f16a6f58277c4

  • SHA512

    792f0c22ed8aef3766f773f4c49698e9d2d2678191c98493e83076fa90dc8a83d67cdd00fe46d7409b4eeb1539c542cd0219b4b9121d45ecbb0ec0ac3bd94baa

  • SSDEEP

    12288:R+vLWa44/RYO83ksdpiVRkvZU08wvzTIVodNgvBqk0WFLehfK2iE3LKvmbrJ:E44/Ky7MN7LT4vBqkle1FPbKSd

  Score

  10^/10

  formbookgy14persistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Adds policy Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2