Extracted

• • Target

    38f284c6ac68831d066f9325b4f8508145ef62146b4c257e3c0a10fdf2305b0a

  • Size

    3.7MB

  • MD5

    fd00d713c843371c82be116049b5a6d9

  • SHA1

    e46e115e003d6088655a5c364d6d03551cb0e41b

  • SHA256

    38f284c6ac68831d066f9325b4f8508145ef62146b4c257e3c0a10fdf2305b0a

  • SHA512

    3f5c7ff62a3f3e7d03c7dd69a3195a93ad0490864ffa10af155085755a1de89f9b27a92e67c84594923b87348b5f192714f33467abbd072ee9a9050b2442c07f

  • SSDEEP

    24576:/gzlt/Kh+sR8/P5fe4VOGLCaIMArRmXCYtXI9yrti7FnVP33hzkZsN:z

  Score

  10^/10

  formbooku31ydiscoveryratspywarestealertrojandefense_evasion

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Formbook payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2