Extracted

• • Target
    hussan.exe
  • Size 80KB
  • SHA256 ffe68860d3d4320a2152bb2f3a636eb0f484f9f81a14b112c5f349b7c3d79f76
  • MD5 a459c1e62b17cffd674cec72dfafb55f
  • SHA1 6004678e8c57bb15179d60ebff70e621eb14df99
  • SHA512 f0a0c3b7da69aeb04007c1cedf421babdaee7e424531363514589edbe6af3ab20b013e470716fe70db87866d39e96054ff4eeb08cc9d178511c0b07752a2cdd2
  • MD5 SHA1 SHA512

  Score

  10^/10

  ratspywaretrojanstealerformbookpersistence

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook Payload

    rat

  • Adds policy Run key to start application

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2