Extracted

• • Target
    SCAN_PAYMENT ADVICE.scr
  • Size 189KB
  • SHA256 017bb0ec25e33f7dbefcac17b8bdfc5ca199579e0d7a14670270eef15ff8abce
  • MD5 58e5625ddd12f520189eb0e06e5bc08d
  • SHA1 8976890c7799f2b43d0f87d13e578971150a2601
  • SHA512 ce8fc7600d350e3ffb9da859fcca89fc359fa2142ddebc23d7f8eac37c950ad05798f13552e3062d75bcdc28f3cf50cd53554dea4adbb9c0da834d2068870dbc
  • MD5 SHA1 SHA512

  Score

  10^/10

  ratspywarepersistencetrojanstealerformbook

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook Payload

    rat

  • Adds policy Run key to start application

    persistence

  • Executes dropped EXE

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2