Extracted

• • Target

    Xgdkayqviz.exe

  • Size

    1.9MB

  • MD5

    a68c8ccf6f70c4622934f393c98ae260

  • SHA1

    27bae542d40db10cd929f2929e10b1c3b601d2dd

  • SHA256

    90c4a79982a1f7b075a45d7bc7d23b5e0ca8ee5348b8762bb301364de22ad33c

  • SHA512

    6caef4118a743e72c979bc33fdb06d055fb80ad0a8a5428bcce511cb0754d404d7aa3a5821941f03c2dcbfd04dcf83f33cb7b69ce0233aef014fac029025e233

  • SSDEEP

    24576:DEx18OfetnSwHwd1rWKLrcpSgZaUZflrGelKNLJygCF:

  Score

  10^/10

  discoverypersistenceformbooke62sratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Formbook payload

    rat

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2