Extracted

• • Target

    Zxooek.exe

  • Size

    2.5MB

  • MD5

    232b1abbe3ed2387bd727d08716e0846

  • SHA1

    d1706a34eed5f8b482655dede78113b5adb04db2

  • SHA256

    5a11fb6ef4be30e7c7a65a256f659fab6b0833f4d32c4922f6fa36b663eb8bb3

  • SHA512

    6205cd30eed573c1dd563adc87be51c21bc14eba36e5ab1e756f715a77e33edf2e97b7884a8b7d2d5c02502495f7dc4b15562237058490d0934aa2b5c985c677

  • SSDEEP

    24576:fPNAyYA6foBNp0kdJV4Eac5h+sXDluxEkTj3v6OVOGH+kDs6+5iQc1RZLszJt74x:fP4ApBz4Eh+szkCkTj3vVnekLBGJt0V

  Score

  10^/10

  formbooke62sdiscoverypersistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Formbook payload

    rat

  • Adds policy Run key to start application

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2