Extracted

• • Target

    Gimegq.exe

  • Size

    2.0MB

  • MD5

    42a6e331406ad55f27ad1e3ad7ba13e6

  • SHA1

    75b2c9970e0a356af251dad5f4e64c538bbb0ce3

  • SHA256

    845cadd4d3a49f38dbd20a685cbd8c0405ca1af4e69aa252082df841a10d16ab

  • SHA512

    2cbbcdbeb156ccfd4b1edabbdf74286418e80bd683b2c002bb8adf7ec02eca78b0da437c413950dd4bda906e4418e310d03db1c2bc74e639702c65b6798ed308

  • SSDEEP

    24576:AJPXX+a20rK/dxUpe8PQBANjA3vDxLM50BgKqd7hpnM:

  Score

  10^/10

  discoverypersistenceformbooke62sratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Formbook payload

    rat

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2