Extracted

• • Target
    August PO.exe
  • Size 567KB
  • SHA256 0bf6ccdd920a50186f7318c51564ecc8f502302b084a5fda3feadb0d51e40f24
  • MD5 1de6deb3fb735bbc867c39ab0fa605e3
  • SHA1 d16db5cf8af609e28f2bf6813b8cd8150f4f73b2
  • SHA512 4a25e6d27bf93ed823c59f4c8c145d5c2e11ba414546cabb22169d028186e3fa27d760718bd48848905c856bf115035d5b384505916c3c091c0bd4d709b8c6e8
  • MD5 SHA1 SHA512

  Score

  10^/10

  rattrojanspywarestealerformbookpersistence

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook Payload

    rat

  • Adds policy Run key to start application

    persistence

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2