Extracted

• • Target
    www.exe
  • Size 1.0MB
  • SHA256 3218d9e3413de3fc262447ccddd5f9f458c82abdb96943e830dfc3ebeb1a1de5
  • MD5 b6fded66a1bf362c4ef98883f04b53ac
  • SHA1 aaa5e105742754c5b250276e916e13ea34613560
  • SHA512 17ce4adce92925b137cf4e3cfdf8b43c705cdf949a139ad2de77fe2579debcf72c0b2d3ab43e58593d66e0167e3e02d9164953c51041006df9a2560b6e297108
  • SSDEEP 24576:lexvf1XsiJ6Y1GxCNEaDfTeLfbCFUGDBOkv95m27R7w:svf18K1ZDbefCuGDBOoXR7
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  discoverypersistenceformbooke62sratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Formbook payload

    rat

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2