Extracted

• • Target
    Payment Copy.exe
  • Size 556KB
  • SHA256 55d2e2a1b94feedfc083326d9096acec664eb4fa66a752650caa62cb9b6c9914
  • MD5 8084dc1e74d897de6ff79693f1def3bd
  • SHA1 4f1537c3f3eada685e439ccc11b7bcf1c1d67188
  • SHA512 e31c533c05d187028625f53aed3f50de22f704472e68725735876b79dec2a55251361ac2c3606d8796feeb9320f69a259a93222602c354d2e066248c0e4dbebf
  • SSDEEP 12288:qdz83kC/aIIAuyO0KEB0gKkuxzYjlwZRJCnhs:qdzVWsV2KEBriyjIRJA2
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookb3n1discoveryratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Deletes itself

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/sydrnwxz.dll
  • Size 138KB
  • SHA256 f2635ca10d2ad2503eefbbfd4673e9c8ad66f363d0117fc4fbd79554ca482f20
  • MD5 f50d919a09c776df2c4fa63e3dcd4526
  • SHA1 917c24b146a6a17ec1cfaebde50199256b4126da
  • SHA512 5b578e7197b7b584185ea83b91938d4b9f152703c6039f98c096423cf94111e2f7146789dea548a2f317d1abf623356d36b4e047ff1d37835572b84020c89bf2
  • SSDEEP 1536:ZacgjVPeGl4bEnfuObM4rzzeZ0oBdpXeIfVMwrc3sYcobUfs55dSKoyrxNURR:gN5a4SYintBZkrFxyR
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral3behavioral4