Extracted

• • Target
    quote204.exe
  • Size 701KB
  • SHA256 0e596eee578e5cc009d172a7dbae0cf150bbf925360389b9961e67c60ab8f3a2
  • MD5 838da2bcdf2df6deeb29971a17485dbb
  • SHA1 68f2b6624cdfe8a84d86e28406542c1246f01918
  • SHA512 b3f04cfdef7281f4cf6ba67c08a515005d20604fad0bbd9a86394d23610b1c069c868797e7804cd1173379dc9cdbb170eed070648e0cbb7fa3737b76392283a4
  • MD5 SHA1 SHA512

  Score

  10^/10

  ratpersistencespywaretrojanstealerformbook

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook Payload

    rat

  • Adds policy Run key to start application

    persistence

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2