Extracted

• • Target

    fcf632af143e88dfba5e9256d0fb238eb314b0d20e63141cb659ed7ad001cbb4.exe

  • Size

    1.6MB

  • MD5

    3364dc2488f8444000a9da4c6d999fc4

  • SHA1

    19cf9bd0f6976d75f7738ec74d2b326edee5bdde

  • SHA256

    fcf632af143e88dfba5e9256d0fb238eb314b0d20e63141cb659ed7ad001cbb4

  • SHA512

    24778076f2e3fbd0ab39675bab98bd7da9feaa08e276d720da2fca252377ceb2c7b1da1b9c3b862e2acbea9b6e0c29e77e093c9cff366055d894a969545ea921

  • SSDEEP

    49152:AAodtaG9kS2U84B+FLan9k5TRM9zlcVj7vdLJ7t:A/B18P7t

  Score

  10^/10

  formbookmd02discoverypersistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Adds policy Run key to start application

    persistence

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2