Extracted

• • Target

    RFQ_10070724.exe

  • Size

    397KB

  • MD5

    d1e512460f6ecd4f7907b81870f9ed9a

  • SHA1

    2e91712215b031056a7425a07fd53457a5ab4803

  • SHA256

    541823134f27a10dd69e8824dc93101dd943730a8ea5f65d9b2ef1c6a643dcee

  • SHA512

    7f0c838cc93b243fc45d1ef1e779022118f6504b8f65542200acadaa18f8864a753fd5f507ca2b4c82ab266ba2b32e2fa3dbcb064201e05b4b20022c8542d55e

  • SSDEEP

    6144:n1FxxGv75a3j51E+S6bjNeksVG9tAA1tIX3NYeI8GYb5D:niD5aTEb6nzdGA1tIYeQYb5

  Score

  10^/10

  discoveryformbookna10ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Blocklisted process makes network request

  • Suspicious use of SetThreadContext

  behavioral1behavioral2