Extracted

• • Target
    CONFIRM ORDER.exe
  • Size 377KB
  • SHA256 e75e9eb97fb635737341ed9fcfd25471fdd9889e75305bbb6b32bbee19b32d52
  • MD5 497d3c3fb025b66cde405926f5ed4943
  • SHA1 f6906ed10c236f360253f8ff28b85263d42eebda
  • SHA512 f4fe42c836409f2e3bf3ba6067a8bcd72f8bbc046a19674ef9c7bc00b288c13151c07a79b81bd8b0e232bccddfe0c92e0fd3edb24387424fad07f2be2155833c
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookratspywarestealertrojanpersistence

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook Payload

    rat

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2