Extracted

• • Target

    7b6405f519c37ee3e0ffd997d6b986b05d415eb21583168b0a9de3ddf042a90f.exe

  • Size

    2.5MB

  • MD5

    d90c90f39b8bf8bc6af9998c546f1df1

  • SHA1

    7358a2cc616bb26f246e4b2bd08ce1c9ca9a0c07

  • SHA256

    7b6405f519c37ee3e0ffd997d6b986b05d415eb21583168b0a9de3ddf042a90f

  • SHA512

    8b6611ad8e281040fce3bf1f5d4abc492570310572ae2dab5022b25c3addb139ecb540ce56bef086c3d3018bf18ded4126cfa2452d7c9ef80a6a7f518b192fdb

  • SSDEEP

    24576:fftLp4xZDonb36xA4XuYaZvpa8pWl2Nootef5OWe16YjlixVPOOmm91U/2TxLauS:d2D1l2No

  Score

  10^/10

  discoverypersistenceformbooke62sratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Formbook payload

    rat

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2