Extracted

• • Target
    10-2.exe
  • Size 404KB
  • SHA256 2d8af025841b523076a35926b94baa786ffbcb5dcf873796ca30bc41f892a867
  • MD5 54cce75f58836bcdaf4dd29dbe7312ee
  • SHA1 cdbb64c652e2033fc3f17297fcfb3af0689503cf
  • SHA512 5162f24bdefc7cb915caf51c930672cb3d2a67725c81a1b0e62c51895aabdc8ea53d01a512fdeeaaba7d20281a7a2bbfa14ee3e2379c06687417340adc816e34
  • SSDEEP 12288:ggD4fqRBdy4r3XyMb6U0tppCGfksVGB6dbQW+M2WUKn:gAfdNXPmKvjYdbd+M
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookdmrratspywarestealertrojanpersistence

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Adds policy Run key to start application

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2