Extracted

• • Target
    wise_deposit_note__1114218690__3287491072__en.cmd
  • Size 2.4MB
  • SHA256 4cb31951ae2b4f8b86b532c25762252f28525f55061d8d09a356a9c8f12029b2
  • MD5 42323f7609e2e5c56add77d01e27432f
  • SHA1 e5262c46781a8c58aaee00a529ed7597dbb2b698
  • SHA512 0814feee3013a4409c3171f30dc9d9d4ffe5626e6ba28a257163fa8f26380751fbd5ba7077e47e9bcd59d8b852b50822fb3383c9a6366b8619db7627d9ded44d
  • SSDEEP 24576:IPHN8ur54cKt8AdV30Z3ZRYwVxrhWHmmV/MBm54hRCKxBJxsv:IPHSur5M8Ar30JnrQLMEBv
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookca63persistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2