Extracted

• • Target

    77295a1c2d8172b2a2eb3f5f20a2880c168dd10f01830227e4f9ae6d4a5c9a19.exe

  • Size

    629KB

  • MD5

    b477c258b8a2af1fd0d9a1da66ae572b

  • SHA1

    9debadcfea532d972d448adec9b84d0b35e3cdc9

  • SHA256

    77295a1c2d8172b2a2eb3f5f20a2880c168dd10f01830227e4f9ae6d4a5c9a19

  • SHA512

    8557fa6fb8210ed787203ae6987617394f0660d2a95c30436f34129bf27b67d8acd7f3e1cb8633fe227d5be9ca0f362634f29026e8992375cb79e624016e05b8

  • SSDEEP

    12288:6QjvOn6nzx8rCf0O94fFWiL0KPhHHdIwCsPtuqrYFNDoCXPq+1:Vj2n6nyC8OSdWiPHcsluq41oC/h

  Score

  10^/10

  formbooka03ddiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2