Extracted

• • Target
    PO200519.exe
  • Size 327KB
  • SHA256 8f71441f8e9db24dceee698de265dab77bda6298ceb4b9bc8cb1d77a54d7229d
  • MD5 ffa8aa6a5db6c0a52a07b89fff2b1849
  • SHA1 2a393c4f489a3842d4a2423478bbd082b3490fd0
  • SHA512 ec8239d1ea1d582c67c5929643f45ce967341502e23a53a4977e1d6ec8c1d65c0195508ad8cf4d6a86d00f085d246e8c25b3b09cdd9dbd721672b7419509d2d6
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookratspywarestealertrojanpersistence

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook Payload

    rat

  • Adds policy Run key to start application

    persistence

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2