Extracted

• • Target
    UNSM-RFQ286-2020 REV1-xlsx.exe
  • Size 637KB
  • SHA256 490a783bc399cb6dd9b64ecc8d0f909830fe1a351d18f148493fcdf6eefb52cd
  • MD5 1f81cb552bc722707ef778cb3457ed28
  • SHA1 166c27e826dc2d13a7f5800e36f759821d1c2995
  • SHA512 1691a9eec7f985db5ba946a349de83d4f575afdc8746a120675df05156a0ec7f8116877250d5bb85e28e4ea090eb165bf99b61daa28abc45506d50b53cff013a
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookratspywarestealertrojanpersistence

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook Payload

    rat

  • Adds policy Run key to start application

    persistence

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2