Extracted

• • Target

    wedmeymarsp.exe.mal

  • Size

    699KB

  • MD5

    875b5af7b5c56f1913978cc8f535a114

  • SHA1

    ce7a41a32572853b609f781e87d99634b9e7a00f

  • SHA256

    3f65f8e74e4ced282a3f46df38dc2550abedf3ffebf6d523386902680905a865

  • SHA512

    9c60ac8ae33ab71ee7b62c451bfbf44ad8918ba7398f1691bb4b759fd901dec3c8fa39848a45b5455de4756bba82f02e76ee9ea909431a9fa27c654b4dd70c9e

  • SSDEEP

    12288:T0VZmK9yx3ASqzgWBYXP5KWcg3AstdkD+gF+G3f6zpjB4ejMp5OxL4SmaeS:oVDQ3ASAIP5Kg3AsTkSgryf4e/4Smae

  Score

  10^/10

  formbooknediscoverypersistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1