Extracted

• • Target

    3122e46802fdd1d353960c89b9d2679e5c818d5cf027dff747acd0d0c2aea7b6

  • Size

    1.4MB

  • MD5

    88f068751d671c40053bdf391c237bd5

  • SHA1

    0885f4d1befb6c12afa526769d6c25ae398412ab

  • SHA256

    3122e46802fdd1d353960c89b9d2679e5c818d5cf027dff747acd0d0c2aea7b6

  • SHA512

    4a9d265e88c98ecee75e8ff01904a618a86c5a315a6095899efa1e98e541a97a54c1097da9243a7b5b0fab13d640d356c8b42c8ff8a6fe0a609ee13558c85253

  • SSDEEP

    24576:JutNHbejV7LluSPKUn+Yw7P20aJRhq+0WBSxJ8sUJjlHcs+0ZlX81kt2i1Pe7Kj:UfHbGRPV67ujzBInUvHwB+Iixy2

  Score

  10^/10

  formbookhwu6discoveryratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2