Extracted

• • Target
    richiesta.exe
  • Size 1000KB
  • SHA256 d8ae48ff83b31d072c1a9d988660e2a0be125aa9373a4adb1dd807d0fea4ebe5
  • MD5 a11723be474379dc80852dfeb99d2b4c
  • SHA1 918834984c6d13577625ae3b93d6207493f7ee15
  • SHA512 24d7c9bfe3cdc67c36b5eeabd26e30a7f894a906fb475ff9996b86994e661bb10492d2c0c8da86aa4f51f1e4d1a02ee33400d24f70a27fb4bad9d07a3bb07036
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookratspywarestealertrojanpersistence

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook Payload

    rat

  • Adds policy Run key to start application

    persistence

  • Deletes itself

  • Enumerates physical storage devices

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2