Extracted

• • Target
    BL_ETA-208324A,XLS.exe
  • Size 487KB
  • SHA256 968caaf20d88166fb2ea2774f772f36a4f070bd6d912f8a1c46c0ae4cd3a31a7
  • MD5 f8a26a984c69fa57f2390bbbd7fb6c5f
  • SHA1 e7a75d5774eb7198634c60a2a4c3becbe55bf8c9
  • SHA512 69131f2a5b5bea3737c269c80e8fdd6b3022d9210862866cdad9760655e606555966142d4894384894888f771acff75160510c773f7f181a5680ff8e12d73d53
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookratspywarestealertrojanpersistence

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook Payload

    rat

  • Adds policy Run key to start application

    persistence

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2