Extracted

• • Target
    000021.exe
  • Size 1.1MB
  • SHA256 9cd4df25010125f2ef3eeef44503b3c2b58435af758fe7213d053a60f018f3d8
  • MD5 e1982141c06e7fab8f93001329630edb
  • SHA1 de17d013de18a44c118dedc9927fef6503186efb
  • SHA512 cfdbe4986a62a74a32c1d7ff023f9ef75b7f46c4cafed40a4f9adddb2b9d44b6ded1e5369119d5dde4423d0ea43e789362cb178240b23b2cd463982b689daaa2
  • MD5 SHA1 SHA512

  Score

  10^/10

  rattrojanspywarestealerformbookpersistence

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook Payload

    rat

  • Adds policy Run key to start application

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2