Extracted

• • Target
    PO C10090.exe
  • Size 309KB
  • SHA256 65cd6807556189c85811f11fb91a981749e7d9760e5a72c0845dd6b8ff93a8f9
  • MD5 52b9520f67483c03673b18e500cdb728
  • SHA1 c23ebfec4a59e85985dabe251390a195ce3d43ca
  • SHA512 38b4ca1c96f6436a7a884ea949af40a2ef52446a0aaeee27e925b8eb8954ded1fcd0f07337d397f9bb4e69c73ccd019826de9cdb0530fa709db7a988cb658677
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookratspywarestealertrojancoreentitypersistence

  • CoreEntity .NET Packer

    A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.

    coreentity

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • CoreCCC Packer

    Detects CoreCCC packer used to load .NET malware.

  • Formbook Payload

    rat

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2