Extracted

• • Target

    RFQ QUG24-200370054200518.exe

  • Size

    2.5MB

  • MD5

    2c797c56fd3f57bfdcad4eb7031733f6

  • SHA1

    4f17ff83965d5d92d2128e7bea446052d5b24444

  • SHA256

    53a5dd5f5446a75a32253a1f365e891e4c4a0cca5284eed39b36737c7fda4000

  • SHA512

    8a39d1c363b2f1d676730fb6d23d837a30032eceebdebc173644336bf1a6c3a45a7406d8d174f331d3f0d9ef373bd5fa8758485bbfec644664357c762854d6a3

  • SSDEEP

    49152:0IMweBemgQmy2tmQjnRO2AJ6896tWieZ0s:8Mm2yvQjnROp685

  Score

  10^/10

  discoverypersistenceformbooke62sratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Formbook payload

    rat

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2