Extracted

• • Target
    QUOTE_3862.exe
  • Size 308KB
  • SHA256 64ff498497ee75879455fa623913eed07fae30f5e357bb247bedcf76e7d4e04f
  • MD5 a9115691f9877af0edd9cb1703470b84
  • SHA1 5ebcea35c9de2bb9f8ed01a1140b1de900afac42
  • SHA512 d9e85b959763dd88f4aa9360981037fa5840995db9bd637f83d7c13c1be0623e2c1d4e845e1e68b2e23ca8ca70e9c530886b5e3539c6e4195dbc2e43bac48160
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookratspywarestealertrojanpersistence

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook Payload

    rat

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2