Extracted

• • Target
    MV TBN -Specification and PL-DOCX.exe
  • Size 1.1MB
  • SHA256 bca55e158b112f5d776f4402d48cdfaf5ae42b4d8f2e063ac69ba2405bfcc60a
  • MD5 03f9ffea8cc879ec181c918152814554
  • SHA1 b778b6ef1adf0eeb945b762a2ac99c893e5be5de
  • SHA512 642843897a84e82491cfa93f430490e9dcf83622c2c344c4c56f15920081665e716c4771f055aafb3b232ad887242ef0ef0785d1ee97b64efda3360b9f5b1e35
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookratspywarestealertrojanpersistence

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook Payload

    rat

  • Adds policy Run key to start application

    persistence

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2