Extracted

• • Target

    formbook.bin

  • Size

    181KB

  • MD5

    ab063fa349f25116b15276ad1e2251d7

  • SHA1

    ddcdf4314f2c187d04a066380d97959e62c34dbd

  • SHA256

    dc769e89feccc886334377b01f29dfe4b36c3266c2df8c88ca704919d0b1b938

  • SHA512

    98abbe10c466b8798093963a479fd8bffcc8027feb2be361a092a98ea32f4960a1dc0e14bbd606752db3950fdb84b17763c81db6911390c88c91fbbacb56687c

  • SSDEEP

    3072:/qpUoiXhkew9hCgu9gbxNkqqh7vIu+fiL2+TLmym/yyA2jh:Dxtw6gOuxaqqh7+aKsCymqHwh

  Score

  10^/10

  discoveryformbookzvfpersistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2