Extracted

• • Target
    DB_ajdi838893noticeArrival.exe
  • Size 552KB
  • SHA256 28ebdc57f4de0a5f04d5ac0c8f17996d257df911de9900c3e6db1f1e213383b7
  • MD5 89a6dc954700b85bfe4290091f475ee0
  • SHA1 e398beeabb7ebfbccf114d6395fb64a41804f3b7
  • SHA512 2d1e59eb58e484645b165b1b8e1d897b721a2037c58ec86e540137236102955f8bb46323bf06ae57f12a4b30a9480c3056fe5a18b605a9dbab55cd558d1ac89d
  • MD5 SHA1 SHA512

  Score

  10^/10

  rattrojanspywarestealerformbookpersistence

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook Payload

    rat

  • Adds policy Run key to start application

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2