Extracted

• • Target
    RFQ-PO04635AZ323.exe
  • Size 461KB
  • SHA256 f310aa4f6cb0b3c3d237d13640594dd0a06f8c42ab5ecd1cba3daecc860129bf
  • MD5 93de480dde266435aaac2a9c0ff59c1e
  • SHA1 56a40e486e6c3a7d7fa458293f39a5d339f89202
  • SHA512 0efd6180c0a4f6b8dc42c07418f1f41117d6c12e982605d577737e7fefe642b3ef1f5152ef44dae0e34176283a10b059f423df4e4d5e083116dd5ee1f7dd6175
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookratspywarestealertrojanpersistence

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook Payload

    rat

  • Adds policy Run key to start application

    persistence

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2