Extracted

• • Target

    SecuriteInfo.com.Win32.PWSX-gen.32520.4342.exe

  • Size

    1.0MB

  • MD5

    b6fded66a1bf362c4ef98883f04b53ac

  • SHA1

    aaa5e105742754c5b250276e916e13ea34613560

  • SHA256

    3218d9e3413de3fc262447ccddd5f9f458c82abdb96943e830dfc3ebeb1a1de5

  • SHA512

    17ce4adce92925b137cf4e3cfdf8b43c705cdf949a139ad2de77fe2579debcf72c0b2d3ab43e58593d66e0167e3e02d9164953c51041006df9a2560b6e297108

  • SSDEEP

    24576:lexvf1XsiJ6Y1GxCNEaDfTeLfbCFUGDBOkv95m27R7w:svf18K1ZDbefCuGDBOoXR7

  Score

  10^/10

  discoverypersistenceformbooke62sratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Formbook payload

    rat

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2