Extracted

• • Target
    Payment slip.exe
  • Size 407KB
  • SHA256 a74dc03e9148e12ba784bf4c26337ceb1d76778a4e9ba036e1fd5d78f42f8750
  • MD5 5cb67a364337bf361b7b961ef87f53b8
  • SHA1 82659cd92f8edba851f24b9d1e8cd3b2358c2513
  • SHA512 18f8f80c504fe31942062007bd1efcc34d897a6a352ffe9219935c9e000142cda16503239dfd265576d14aa8f5bdf477e84073183dda04f1d6e9c574919c9c1c
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookratspywarestealertrojanpersistence

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook Payload

    rat

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run key to start application

    persistence

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2