Extracted

• • Target
    invoice copy.scanned-view-intl.exe
  • Size 353KB
  • SHA256 a0c49ccef1033cbd0119355f93a8109dccf48d53f0fc155e152efaa7ebf44a5a
  • MD5 28fcf0d7d61f5f19e97e295726fb6fb7
  • SHA1 f0e1edcb9fa36a79b98e74c4a53078d9cc60e4da
  • SHA512 e2838614fb14098ab544dbe6ecce8742a307eda34849844747f0768558c54f5e992826609286cbd3bebd8fda6363e26639589f960998f7806e24ac34a4b44d47
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookratspywarestealertrojanpersistence

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook Payload

    rat

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2