Extracted

• • Target
    PO7329HDDSF.exe
  • Size 386KB
  • SHA256 af7b3fa36f4f307300ab9a8dc34806cdcf9fce5fe857e9f1b2ddc8e6def9f518
  • MD5 17e6819bd7e677b338c2c0e71bdd2a49
  • SHA1 aae331569b1d3069d104e900180a114b04df18ee
  • SHA512 e31ab079264434c70f96ce327750f597e56cf2fe18a86932e6b7c83c866b50487f80d2a5720dc1f276b444f45641dd220132578b47d11334363d0d8825715b43
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookcoreentityratrezer0spywarestealertrojanpersistence

  • CoreEntity .NET Packer

    A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.

    coreentity

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook Payload

    rat

  • rezer0

    Detects ReZer0, a packer with multiple versions used in various campaigns.

    rezer0

  • Adds policy Run key to start application

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2