Extracted

• • Target
    S-19799C.exe
  • Size 633KB
  • SHA256 55c852b0c762e30f96e7948cd2db3f940f8a18714f4c8146775d65e53f9fd385
  • MD5 d7bd3e606c11ebcf2262604c19538bcf
  • SHA1 2e25f74cfc2acbe56592888237270d8f6f6df50d
  • SHA512 8b5873e50dd6f8a899f723881705cb8187730caeeb1d9432deacf90a77b950dc6104c64bdeaa66dd98c20c0ac70c0a9e2a8f4042ce406ed77961a4820d431d5d
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookratspywarestealertrojanpersistence

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook Payload

    rat

  • Adds policy Run key to start application

    persistence

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2