Extracted

• • Target

    PAID CA2686+CA2687+CA2688.exe

  • Size

    1.1MB

  • MD5

    a4b51a4a802bbd22c815f978f47ea06f

  • SHA1

    a8735f152d4e1e21d2ed3095821b909b022a4201

  • SHA256

    069a4c2c42050c9037f6a11f9083b312c8bc3159fbe2b73f1e84760da762e6a8

  • SHA512

    2733cd65bb29eaedf08dc0a9a4e577e01b4198240edc1c461e9efe78145071970c5116849f7a37d6a7470ed0c7b82ce6b40ed9df7c1aa011406ba2f158f405d8

  • SSDEEP

    24576:WfmMv6Ckr7Mny5Qt4BoW8YCj0cdbtMQ6gLgj:W3v+7/5Qt4BoW8O+jgj

  Score

  10^/10

  formbookcu29discoveryratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2