Extracted

• • Target

    a0b19468a7896874e57b014b28e8d3abd1707e2b52a8ef1bf516d4c1a76a7b42

  • Size

    868KB

  • MD5

    f69ca46a59bc720a3edf4a1c3698418d

  • SHA1

    f0e01c9a9ca63d1b1d507be06bc9aa2c044db500

  • SHA256

    a0b19468a7896874e57b014b28e8d3abd1707e2b52a8ef1bf516d4c1a76a7b42

  • SHA512

    835691dd5cf84e272384d5203b89e18c56f6509e74cb9fc60a4530e8fa27e292c76b91703b75940d1a4df4900e14dca376f494ebbb3ce92f8ee6f24b2de159d6

  • SSDEEP

    12288:exTd+lc9ogYATuMFct1sPdqrQ8IvPHMvUok5pPzoADqjJ5n:Y6ccXhQnPH4k5pejr

  Score

  10^/10

  formbookgskidiscoveryratspywarestealertrojan

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Suspicious use of SetThreadContext

  behavioral1behavioral2