Extracted

• • Target
    order inquiry.exe
  • Size 417KB
  • SHA256 3df6c5354d1899b7249078b6aec00872710092c2328c0a3e20c79409f42adad4
  • MD5 a15202c9f382be718047dee5b8570754
  • SHA1 aff3dafbbb6f8fab6791aa5f9cbc18a164da68d1
  • SHA512 677ec10c2f8bb217d510da13e939162dcbc6581914f5309a72af1ebdb1fcf9e97af13c3cc325dc1ab9995c645dd3027bdb2271e12dd516ebcadb83a7d59178c1
  • MD5 SHA1 SHA512

  Score

  10^/10

  ratpersistencespywaretrojanstealerformbook

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook Payload

    rat

  • Adds policy Run key to start application

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2