Extracted

• • Target
    d577dfa0273275bc6013e1c893a3da5e8744dd7a7dd52a7b072032b86e93c1b8.exe
  • Size 1.5MB
  • SHA256 d577dfa0273275bc6013e1c893a3da5e8744dd7a7dd52a7b072032b86e93c1b8
  • MD5 caf053b7452bb345a2e751ecf92fe668
  • SHA1 b50eab859ed3e6462cbca4e386353b65d19e5932
  • SHA512 d9ab02ae288a5db1bc41f4ae67a0564b909b34b98b8bd492ce334c57df0e1704af35348d980629813dd17e6a10c09fefcafb29c23c07bb694d0453d4aec9035e
  • SSDEEP 24576:qisp/COjcSNvhPgdqC6AdpHtcGoWNLBMK61vxuxHdH8hgC/aJ1MmVkkkkkkWxkj:qDC4Pgp6AvHtRDvV08x9HOaTVkkkkkk
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookca63persistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2