Extracted

• • Target
    Commercial Invoice.exe
  • Size 809KB
  • SHA256 2bde8d605b2ce54ea697cab8be4daff0c2349322b42a96c8a9237ac7eff35314
  • MD5 b9acbd74ef64764ea09a0f21eb887ba2
  • SHA1 f32bd69bd927e98f13cd6168d2cd75b93bb1c27e
  • SHA512 c23f7e7bf3da74af8e3dcd6bc349f46d58eee6c327ce3ab1176fc0d2e0160570c4d43cbde4ab5910e69693cdff48f00faa5e6e7be2aa0c15c8a7f7abe2a6152f
  • MD5 SHA1 SHA512

  Score

  10^/10

  ratpersistencespywaretrojanstealerformbook

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook Payload

    rat

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2