Extracted

• • Target

    S12GF803.exe

  • Size

    252KB

  • MD5

    6aeeb261a692fa9e104320c7247968ef

  • SHA1

    96c1ef5d7f32c4701557aba801ddf192f19c163f

  • SHA256

    4f6f954d067f1af2bf8caca9e7ea103d8dbfb7507514847b999328e108b456af

  • SHA512

    04f189b93c29424f4c840484f19beefaf831952e62b47bc3f03699a9bf084990862638432371d029babcbe7d437f7ae6f91a166fc1b377932ab2d24a1f974bbb

  • SSDEEP

    3072:/Nyah0mJh4IKLAtHeekOLYkX2Y5hpwdYfBiZVekqdz2wB1EcbTVdEuCPxbS3G549:/waqMYkmY57wdNZVLcqw8cbzP/F9

  Score

  10^/10

  formbooksl12discoveryratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Deletes itself

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    $PLUGINSDIR/gtrvk.dll

  • Size

    5KB

  • MD5

    3627e0a769af64650e5ce46db6bb0532

  • SHA1

    e203eaa9b1ad5d324af6696f5d1a62cd58e3513a

  • SHA256

    a5699137065d3f0f5a26372a17eecc76905599435d866608f10c38760eb43e52

  • SHA512

    044cb6198c848e4edd870fc9a5647e6a4644753986f2557da0babb0c9004ca14031b93c4db92d84754a297619bb87bdb6f847a3887c037180df4603583b908d1

  • SSDEEP

    96:q6nmydg7sZIu+kYVz2LIu+3PSehGfZSfl59CC:B1dvIH+I+e6AfR

  Score

  10^/10

  formbooksl12discoveryratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Suspicious use of SetThreadContext

  behavioral3behavioral4