Extracted

• • Target
    Confirmation coupon.exe
  • Size 1016KB
  • SHA256 37e7b7329552ca9f6ab3233ebe1d8ab96c4385b941b31a21ea43c4c2b85fca61
  • MD5 72ae0dcb4e1ee4967c220fdd458eeada
  • SHA1 5dc0fbd12332e524b1f3c87854e11426d249b998
  • SHA512 711c2dd59b8230dc104d8bff88beeebaa909c869e0380f33684fb32dcde2b11b8a71e1c19626079246c455420bc2de1a3226f870b0aed70d51d54f5a6dfe3745
  • MD5 SHA1 SHA512

  Score

  10^/10

  ratpersistencespywaretrojanstealerformbook

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook Payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2