Extracted

• • Target

    rNew_PO178391922RFQAmended.exe

  • Size

    1.0MB

  • MD5

    6af2e8d3a281642512d1dfc59619f83c

  • SHA1

    7a4fe8bfa3c98873a8d73e2b8054aac34d42f448

  • SHA256

    68812ea5d94f9af1fab9e3b3241390fb7404a4107bf610ca7ba21678cf500d46

  • SHA512

    af2c82e5953be56c3bf020d463f216b7b4ccab1495bfa87a1ab56b31f98bd78c6417793ad8954e974cd2a3a658d1d9cef2a54d47249c01af7f27cbdb25e46598

  • SSDEEP

    24576:au6J33O0c+JY5UZ+XC0kGso6Fa2XWR43fLDfYER/bdGWY:su0c++OCvkGs9Fa2Xq43fffbjY

  Score

  10^/10

  formbookts49discoveryratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2