Extracted

• • Target
    Payment_Advice.exe
  • Size 815KB
  • SHA256 8d692269e00163075c2d1bdeea0d8fe0ebb06c791233f692fa76e766095ec3ad
  • MD5 05a028bf7e8b4118a97a57552fc4ba0c
  • SHA1 9e71f8d3fd4bddb603c4c1803c867cade9be7a83
  • SHA512 df27cb22cbd3ee8faa970ce11217ac408c5e91e6cb4f81ad9f50b520cdebc216fee99ac022c41db449981ceadf5fdd4516b536641dbaf5a291125053b484a867
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookratspywarestealertrojanpersistence

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook Payload

    rat

  • Adds policy Run key to start application

    persistence

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2