Extracted

• • Target
    SARS Notification.exe
  • Size 899KB
  • SHA256 be4b642f44ecf847a15699b7a93f52876389fedf12c8b03e51a4ec5c14032bc7
  • MD5 09bbef861ad74c9ea22a7f878c032f4a
  • SHA1 76fad62ab0b477ea0c59661c297cdb6960773a0d
  • SHA512 42379d725503df5a5a5a53e8fcc5987bff06f51db2dc21ed6671afff2ef7b6119f794cd4a4ec8ae91a1ec02ffa2684d88652315d26c2173daeaf323d24e28d13
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookmodiloaderm2h7persistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • Formbook Payload

    rat

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2