Extracted

• • Target
    invoice.exe
  • Size 662KB
  • SHA256 b6bba549cf3117215c67958b942340703dbf010048d3fc7ecea2871d1d4618e7
  • MD5 2f279fe487e7fdb78653123612eedc20
  • SHA1 84546165757a57ea4be153431301d1bd3844d013
  • SHA512 0523508632ead01bb9b4b0dc725ffdccf1fa1a9a7fa71c0dbe0618884e39e5d0c1d405c52275ad35f17373c9129cdfeecbfa3fbadd0303dac7c46fdad412c59c
  • MD5 SHA1 SHA512

  Score

  10^/10

  rattrojanspywarestealerformbookpersistence

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook Payload

    rat

  • Adds policy Run key to start application

    persistence

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2