Extracted

• • Target
    Scan_07062020.exe
  • Size 335KB
  • SHA256 1fa61bb029466f4fe3ed9385994dcaed8b25715931e460f9b4db88ec155ec6a3
  • MD5 0efca6807eac19cadeb17ec53e9c7cd8
  • SHA1 68d4ae01ba1fe5af81b634cb569e2062a11b305e
  • SHA512 d9d4c2fa717b42a057ae610941baf33b2ca53daf9a61f13aede7c498ae5b2af62424e6ed0de78381fa621124698fa06225293ec71203058219dc18761730a949
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookratspywarestealertrojanpersistence

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook Payload

    rat

  • ServiceHost packer

    Detects ServiceHost packer used for .NET malware

  • Adds policy Run key to start application

    persistence

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2