Extracted

• • Target

    tmp

  • Size

    247KB

  • MD5

    5e822f4a547b3c11badbf4e7c32855b6

  • SHA1

    1095d99f92c01e305a4ead8bcfa57e2a3e60e881

  • SHA256

    86369d60c9f6b68598952379aaa9b0d3b7af84294b4aece68359552287d3456f

  • SHA512

    d1f64cf86427ab3d343784f8a018d80936d66f4a14d2f8db7023873860674320ddaf7dc708214af1473aad2c9b3565ed5d7d874c2098a0cb8db30878375765fd

  • SSDEEP

    6144:Lx8KOdzOqfSK533Uaz42DfXT/D3WRJXhHy5ieqYJAMxFMc:iLZO6XPDrbmFHy5iuDMc

  Score

  10^/10

  formbookgautpersistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Adds policy Run key to start application

    persistence

  • Blocklisted process makes network request

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2