Extracted

• • Target
    Scan_03062020.exe
  • Size 568KB
  • SHA256 ebb20ece00b9d35c26bb797dbbbd6df726473e198a53095cb232dc8042c18d7e
  • MD5 a2d6ec11cb9f5d84ec286e04ffe53e9d
  • SHA1 c1b71a77289261258d63964f1f6c661229cee80c
  • SHA512 a4deb7bc658d767d257e52f6e157b2b21c544b26ac41b9d31d91f895cace9452f5fd8d9a1d3d10f7d1441d3f6d79bea63439dce4c3052e24704baa082a840735
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookratrezer0spywarestealertrojanpersistence

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook Payload

    rat

  • rezer0

    Detects ReZer0, a packer with multiple versions used in various campaigns.

    rezer0

  • Adds policy Run key to start application

    persistence

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2