Extracted

• • Target
    ORDER_89103.exe
  • Size 325KB
  • SHA256 6012fb54cc0a67842710e7189ebfa42c27d30f18a604fbb4122734fb23b7accd
  • MD5 14f9d04f8bb6a284fa3c62cb937b07c9
  • SHA1 306dcfc01101bfdce3d08b7732473acb98b21e09
  • SHA512 53ff292045add93d71f5ef9934d6104de27fd724b543d5a239f80cd445e16a50a7cb57598032a0fced90d91c5d5366e48c5a03035321b6a50c40425752a4afd2
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookratspywarestealertrojanpersistence

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook Payload

    rat

  • Adds policy Run key to start application

    persistence

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2