Extracted

• • Target

    PURCHASEDORDEROFENG091.exe

  • Size

    24KB

  • MD5

    30ecd7046839af0716977a9ef6047e60

  • SHA1

    a1f6517726c9dc0f3d588b947e2aaeb4f849f58c

  • SHA256

    472a703381c8fe89f83b0fe4d7960b0942c5694054ba94dd85c249c4c702e0cd

  • SHA512

    7dad8ec1c5040112deee48ef6dbd56e7aac3db65dee11568f5e9fea96b33b2b6030f560c834ba51dcb0cb98eb837c2638e7f9c8b39c1f46395bd8259c88f8937

  • SSDEEP

    384:zZizC2pKXg9eH58VkRS/oFGPikzhlZBBmBi1S0f9EKR4VWjs5anwNmJ8sxSvpphB:z/wJevBzM6RB

  Score

  10^/10

  formbookbtrddiscoverypersistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2