Extracted

• • Target

    13441db4f2c8574a8d90d1b5167b1f4b81bbdcd77a1e0ba44517017874d02618

  • Size

    1.3MB

  • MD5

    0d5d79a8b715e13a26e6579f1d47c0d7

  • SHA1

    408402dcc517ab7be7957ff867b7464cc1465334

  • SHA256

    13441db4f2c8574a8d90d1b5167b1f4b81bbdcd77a1e0ba44517017874d02618

  • SHA512

    d2642be20a3f7114ee1caec6253caebdb213709590ba14051391eb72f0f10018fa634db5ff735a88e9ff2aefdf5af208bd3cadb5b2dec070bee8bbd7decded05

  • SSDEEP

    24576:KngpIDsJ34JbFQ4YBolrs08Qt/horbWgMhSpA6+jzfievtzAQSX1:KnYmscQ4goBsmYBMkuNjm4tuX1

  Score

  10^/10

  formbookhwu6discoveryratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2