Extracted

• • Target
    Purchase-order_622978.pdf M02-518B.exe
  • Size 330KB
  • SHA256 7e1cc3c2c72032a35e00a39574018d4dc7b5c8b4a2b52e865be86cea4fb03436
  • MD5 79476f26c5774007cfffcdabb4352b33
  • SHA1 94953cedbd75ef57005118db9d3b6235d05eea8a
  • SHA512 49cf05a97308220881c5c18ec2b1d40891e042bb69258283d2af32d9f949a832a01b4f00904fc64db41e2b1f43fcd2cac2f46acfc90108e325270b3343fc1208
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookratspywarestealertrojanpersistence

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook Payload

    rat

  • Adds policy Run key to start application

    persistence

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2