Extracted

• • Target

    fd828c534b0e6ce946192311dd9fadad98e82fcc91fe1f3bdbdc652ccc3fc3d0.exe

  • Size

    1.6MB

  • MD5

    f6e047942236cefdcd6559bca66a7b3e

  • SHA1

    28aac545fcd0c9b11d2546110966b812d1c6d920

  • SHA256

    fd828c534b0e6ce946192311dd9fadad98e82fcc91fe1f3bdbdc652ccc3fc3d0

  • SHA512

    5cb5d39d739e1698772e59b3f50da44cb7279a3f7df1ac5319dedc823f62ecf14f5b0ff68c4e67fe8e1595235242f83d17c86b50e82c16b8c8e6cc40d7525eeb

  • SSDEEP

    49152:WAodtaG9kS2U84B+FLan9k5TRM9zlCVjkvr:K/B1Jz

  Score

  10^/10

  formbookmd02discoverypersistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Adds policy Run key to start application

    persistence

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2