Extracted

• • Target

    1.bin

  • Size

    743KB

  • MD5

    23713e079ab57e334b8cb4116e7a1318

  • SHA1

    7f1a8448ccc5ccf5e3758055f89ee156e1a17ff6

  • SHA256

    c89757583d8df1ff56a4a8a4efa66666d02af3807b60cd058031afe1aebaeda8

  • SHA512

    134aa0ab39d5f4241362753c9a414542673a66ccebea89910ce867574e5075c880052f89cc946e1d735e904eef2685c8598c4f39ec82a5c54c60a1e5a47e43b8

  • SSDEEP

    12288:bxojH5jdL/KyCR7PqRo2YQLa3RFC7cvoLTKF99AQ056islwo8ZHo:+ljBKnRIIQOhKcCTKFPAQ05Dslwb5

  Score

  10^/10

  formbookx0hdiscoveryratspywarestealertrojanpersistence

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2