Extracted

• • Target
    RFQ 242024.exe
  • Size 1.1MB
  • SHA256 ff410475bb80926bc3933e68f5e84a7185292bb2b78294abe528cb647c78f637
  • MD5 5fa5f00b74bf9bb524687e6785027135
  • SHA1 4f41d3eddbf7844cc60f561c6fd92c44f7f4f282
  • SHA512 5bbd12cb28e0255a6773e11c2c096a94ec018228dd8dfae107efdd4bb193808463849872175f9798de27705fa5f9b5232bc10ef18c726ebee3c222aa3b2b3f9f
  • SSDEEP 24576:WfmMv6Ckr7Mny5QtEc7e74/SPFjc2+ZWKrs3bC+:W3v+7/5Qtl7k4/S1tGJaC+
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookcu29discoveryratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2