Extracted

• • Target
    offer order.exe
  • Size 1.7MB
  • SHA256 aa840ddac1cbded575db7d3ee2d1e3102fd1c35d0a709f42209543f9913e438f
  • MD5 10419c97cde1aa8bad4e33279a15f7f8
  • SHA1 b2942c499632593cface5c1fd18c12105656bf75
  • SHA512 c77bc2ead1869aced4a8e2955317c5cf99bbb68e35d54ec4d8794a6794bf3dda3b24764c8ce21bddf9ff09372565f08e3191a2c46fcbbfaaf649fa5f47bab0bc
  • MD5 SHA1 SHA512

  Score

  10^/10

  ratspywaretrojanstealerformbookpersistence

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook Payload

    rat

  • Adds policy Run key to start application

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2