Extracted

• • Target

    New order list.exe

  • Size

    702KB

  • MD5

    b547ecb89df9e1ff489f6147aec4d24f

  • SHA1

    3fedd95046f51ae97519463a97dda493485e88c9

  • SHA256

    a9a8118ba7dbac756aa0778ec6680ec681ad2e0bd4ed6ccc121c22b73dfe7b29

  • SHA512

    83a3458904f37a941436fecd117177e9907ec97dc87bccb44cc7c5517aab9ac598f2ed4b07121d530bfa05b5ff683bcd42b4dce85d575c15bc077a19a2c2afec

  Score

  10^/10

  formbookpersistenceratspywarestealertrojanmodiloader

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • Formbook Payload

    rat

  • Adds policy Run key to start application

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2