Extracted

• • Target
    DOC99281270.exe
  • Size 477KB
  • SHA256 2a6f4ceccb614247724bff7ecc0241c756b3d0d971734ebf7d15d2c822975ff1
  • MD5 708a1b01fec5b30cba9afffb119eb4f4
  • SHA1 090e0407aa4b3684699b2fb749796e3f2c5de188
  • SHA512 83672f1ffc5d47c2412fc236153728959dd1d065dd9b07c859b66d4caba8ff76579bc92894a537256fee8705a7a27ffae1f26b4900e1b0a210cb1d236eca649d
  • MD5 SHA1 SHA512

  Score

  10^/10

  ratspywaretrojanstealerformbookpersistence

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook Payload

    rat

  • Adds policy Run key to start application

    persistence

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2