Extracted

• • Target

    PO 778000 - JPG.exe

  • Size

    338KB

  • MD5

    95913252240e4a65881ed6cc1126be23

  • SHA1

    9e39d022d13736cf732add2ca97f370ce2c9e704

  • SHA256

    77df1a0146ca3b32c884fea68e1c16af0beb5b30876fedb692bed74b6295bad1

  • SHA512

    ea1d233bdad2eab4109d13d45c8220a89c50c6773da142476851b474cb95c26095409688089062bffb1bcdb8e34a520cfeb5e08f82335ecefae144b4fd5e284a

  • SSDEEP

    6144:Q5lz/PsxMKrNPWG5vy6FQXe2D0ZwBmyeBzqgWw22:AVIpVpq6R2wZwBmGg3

  Score

  10^/10

  formbookc206ratspywarestealertrojanpersistence

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    $PLUGINSDIR/UserInfo.dll

  • Size

    4KB

  • MD5

    9eb662f3b5fbda28bffe020e0ab40519

  • SHA1

    0bd28183a9d8dbb98afbcf100fb1f4f6c5fc6c41

  • SHA256

    9aa388c7de8e96885adcb4325af871b470ac50edb60d4b0d876ad43f5332ffd1

  • SHA512

    6c36f7b45efe792c21d8a87d03e63a4b641169fad6d014db1e7d15badd0e283144d746d888232d6123b551612173b2bb42bf05f16e3129b625f5ddba4134b5b8

  Score

  3^/10
  behavioral3behavioral4

• • Target

    $PLUGINSDIR/vivo.dll

  • Size

    12KB

  • MD5

    0d7ad4f45dc6f5aa87f606d0331c6901

  • SHA1

    48df0911f0484cbe2a8cdd5362140b63c41ee457

  • SHA256

    3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

  • SHA512

    c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

  • SSDEEP

    192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6

  Score

  3^/10
  behavioral5behavioral6

• • Target

    $TEMP/SecUtil.exe

  • Size

    36KB

  • MD5

    0b26c254e06c600fa551cc9c639946fb

  • SHA1

    11bbf13d60393c51c36906a6b9de6e869f562155

  • SHA256

    710ab39b849a955c0cc86baad695a774567ed1d770bac5f9b3ded8824356572c

  • SHA512

    109580cca933b2368282fed547f9894bad965d37d495c97564c7b83eedd1976a2aff930b8244f7e6492dbefd06404bd9f171f98fc56c3693d1de70511f60d7a4

  • SSDEEP

    384:3xzdfgwTgENSwUi8w5cB+8QZQW7ixtNH8MH2je+lZIbg6ihJSxUCR1rgCPKabK2x:3xpZUeUi8w5ctQZot+MH2mFRJhggW

  Score

  1^/10
  behavioral7behavioral8

• • Target

    $TEMP/luciferase.dll

  • Size

    92KB

  • MD5

    696e0a3df2927dde205b3d1894677e1e

  • SHA1

    b10d49e4c2809e4ea9f814fd6a0a311dad62fbe8

  • SHA256

    936babd677d69c25715d1ee19c66c18d33ff439a329c5476d59af2d54ba79bd2

  • SHA512

    e688abb18745843b2ee018eccfc3de0fc58eb3df39a993a2f825725739862b93950ca2f164f0734e72d64b64f94720746eff4bb6d2c8cc81eb91abeacacc63d9

  • SSDEEP

    768:/JNGCURaXC8mbKyv7oAk3pfd7fIWmr/ph6KWzmgZh0HA+711t+c4qvOZNIC:XGznoAafd7gWc/pazvqRntKZNI

  Score

  1^/10
  behavioral10behavioral9