Extracted

• • Target

    New PO 796512.exe

  • Size

    21KB

  • MD5

    223b42adc2e6eeb342664ffa633c3a6a

  • SHA1

    00612d9ce02cde93cd73eebcbee0deece4da3f8f

  • SHA256

    68c3605100b20d0e04a069565f5ce7f6f55b7546f52dcf22328e3a321637e361

  • SHA512

    8c2e1ca20137aa4871509dbf17d27eeed4ae13433f95b63eda48570b2158317d3d72edda78f7b6c43bbc4f39c5bf84d83988c6afd6a5e6f1bdcda331f82c6847

  • SSDEEP

    384:cs+2GqOOyQuluvnDS3d2dD03jVsV8ftnokwRwAoDNwAUPNtdI6+eQAozrBtHzkL:cs+2G8ZQ+SXjWooPjBBAtHzae6eX

  Score

  10^/10

  formbooko62sdiscoverypersistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Deletes itself

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2