Extracted

• • Target

    6ca39f7a18248a826714e89d6cb52e7f952d36d3f3a7be1b96c6a5a39ec4adfb

  • Size

    642KB

  • MD5

    d836f401150d3edf804fb32e913cc1ba

  • SHA1

    b6b96c22be56065a6015fd27eac39cfa33d50848

  • SHA256

    6ca39f7a18248a826714e89d6cb52e7f952d36d3f3a7be1b96c6a5a39ec4adfb

  • SHA512

    fcd711df3a7f36f456e9fc6d011c7721a2ddde0d90368737202285350bab3af592e2481e1078cc7aeec7ce79bffb991ce026ce0d4f5ec26d3b713213a9434990

  • SSDEEP

    12288:kqp3tdo8hIoADb+1AYjnc7AwYjSlylSx1LS+I6+a48P/t22FTrEV9jy+:kK/87Dbujc7AwY2

  Score

  10^/10

  formbookbnskdiscoveryratspywarestealertrojan

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Suspicious use of SetThreadContext

  behavioral1behavioral2