Extracted

• • Target

    MEmpEng.exe

  • Size

    604KB

  • MD5

    dd2e0becfb1316c49975386fc3367c45

  • SHA1

    98c578ff997ef781919ca5967251fa9d462a756e

  • SHA256

    14d4d6df33e96af2a1d5ef8f8e7f6f1b914b0342b219c75f812848f52bc27628

  • SHA512

    4768fa7aa32dc02e958c8506880311bb0d4fa5a9cd9fcdc6581a8349b1d85b3323513d28018b55ffbdb79e440e4b371dfb260cbd097ffd2279993b9a1a416bfb

  • SSDEEP

    12288:MVVeXpcIofxcshf8R5wjY/nCdfpfwzW2kTFzcdppLLO:eePofZhf8BnCbft2kajy

  Score

  10^/10

  formbookb48ndiscoveryratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2