Extracted

• • Target
    SPD-P-2995 PKG BOILERS_pdf.exe
  • Size 641KB
  • SHA256 be4207b3c6def716919d01b666d9a78243730825f095b30edca4dfdae1f9096f
  • MD5 f602dda1b7a23b77158e6971260046cf
  • SHA1 0fe9101cf032f492d3eeafe29cf2f205ac28a9a9
  • SHA512 d7d82fa4c7ddce9d76e07a6dd7562776f166302af65a54c24a4ae33e0cf6b7594b2040eaa9e39cb9ef80c7d38bc8be3e0ca9a963e47ed4dac13c66fb00396e56
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookratspywarestealertrojanpersistence

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook Payload

    rat

  • Adds policy Run key to start application

    persistence

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2