Extracted

• • Target
    RFQ052020.exe
  • Size 933KB
  • SHA256 4b2c4e99f90ead8a22dd705733b21dbc32b71344e2022e229ff59d967e359203
  • MD5 01ddf6ca2d833e79e1ea1000b3e8b260
  • SHA1 ea80008fc1e35132896f38184ccb848dc1d4379f
  • SHA512 c3e131acd9dc02389da78209f2c38bf351fc79fe3f486e726edc0710fbe712fa90001f5ec3ecc7525d8b9172205be10694fdf05cc70c3dc949557585aef3c9e8
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookpersistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook Payload

    rat

  • Adds policy Run key to start application

    persistence

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2