Extracted

• • Target
    menu.exe
  • Size 406KB
  • SHA256 978d9731a42b87de3650a93cd5291e890c8f85f6aaa00f78547be6dabb327817
  • MD5 0cc826e8be14c3e4b28ce11cef9a84da
  • SHA1 024402ba8772ccd3a74d1898e67f7b4a082e8b6e
  • SHA512 1a02e7d8c5a5dbaa05d6ca3826af13586815032b0682dae130cafe97cb5627a016a18a8a78126adb3185fef18293f821405ce3724e0ef53ce1fe7bb4b5498d53
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookratspywarestealertrojanpersistence

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook Payload

    rat

  • Adds policy Run key to start application

    persistence

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2