Extracted

• • Target

    vstdlib_s64.dll

  • Size

    10.0MB

  • MD5

    897e2193493cfd989d82f6a559bf1b2a

  • SHA1

    df837bc19bf863ce466588ca3121fed884922b90

  • SHA256

    92958c2e2d940de78a7f5352b00890f291d568816a8fe1b2bf8c572941644ec0

  • SHA512

    761d12c8ebf7df3bbdc7cddf1220065a4e13780057c99b2e43bd653f1c00154ad9e1c8f2236373d54c985ee710c8847813223d244ad170c678593b3ce8e97996

  • SSDEEP

    98304:nt/DDvVWLvBmmZCPPSVHxySAknm58mQzKSawKlhW1TS28kvGGp:t1WLvBzCSVHxySAknm58mHw6hKVGGp

  Score

  10^/10

  formbookgt23discoverypersistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2