Extracted

• • Target
    PO 14544.exe
  • Size 669KB
  • SHA256 c7544c2d4180660fc3a96f3b66b5caa0e168dcfbb35a870f1c576a152ed62348
  • MD5 4d2fb973d84c8528bd40f4173e87dfc9
  • SHA1 8b0099a296433b49e0c00b03d895b3e4a65feeb3
  • SHA512 f2002cc408ee1c6fdce50a72559b03fe18a9ec1e3a23c15aa44f493dc2c6610ab4407fed01a540ac3fbb2bc1667c3dae428c4fd8c6b8e0db8684b3bef15f43a8
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookratspywarestealertrojanpersistence

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook Payload

    rat

  • Adds policy Run key to start application

    persistence

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2