Extracted

• • Target
    PO 778000 - JPG.exe
  • Size 338KB
  • SHA256 77df1a0146ca3b32c884fea68e1c16af0beb5b30876fedb692bed74b6295bad1
  • MD5 95913252240e4a65881ed6cc1126be23
  • SHA1 9e39d022d13736cf732add2ca97f370ce2c9e704
  • SHA512 ea1d233bdad2eab4109d13d45c8220a89c50c6773da142476851b474cb95c26095409688089062bffb1bcdb8e34a520cfeb5e08f82335ecefae144b4fd5e284a
  • SSDEEP 6144:Q5lz/PsxMKrNPWG5vy6FQXe2D0ZwBmyeBzqgWw22:AVIpVpq6R2wZwBmGg3
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookc206ratspywarestealertrojanpersistence

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/UserInfo.dll
  • Size 4KB
  • SHA256 9aa388c7de8e96885adcb4325af871b470ac50edb60d4b0d876ad43f5332ffd1
  • MD5 9eb662f3b5fbda28bffe020e0ab40519
  • SHA1 0bd28183a9d8dbb98afbcf100fb1f4f6c5fc6c41
  • SHA512 6c36f7b45efe792c21d8a87d03e63a4b641169fad6d014db1e7d15badd0e283144d746d888232d6123b551612173b2bb42bf05f16e3129b625f5ddba4134b5b8
  • MD5 SHA1 SHA512

  Score

  3^/10
  behavioral3behavioral4
• • Target
    $PLUGINSDIR/vivo.dll
  • Size 12KB
  • SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
  • MD5 0d7ad4f45dc6f5aa87f606d0331c6901
  • SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
  • SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
  • SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10
  behavioral5behavioral6
• • Target
    $TEMP/SecUtil.exe
  • Size 36KB
  • SHA256 710ab39b849a955c0cc86baad695a774567ed1d770bac5f9b3ded8824356572c
  • MD5 0b26c254e06c600fa551cc9c639946fb
  • SHA1 11bbf13d60393c51c36906a6b9de6e869f562155
  • SHA512 109580cca933b2368282fed547f9894bad965d37d495c97564c7b83eedd1976a2aff930b8244f7e6492dbefd06404bd9f171f98fc56c3693d1de70511f60d7a4
  • SSDEEP 384:3xzdfgwTgENSwUi8w5cB+8QZQW7ixtNH8MH2je+lZIbg6ihJSxUCR1rgCPKabK2x:3xpZUeUi8w5ctQZot+MH2mFRJhggW
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral7behavioral8
• • Target
    $TEMP/luciferase.dll
  • Size 92KB
  • SHA256 936babd677d69c25715d1ee19c66c18d33ff439a329c5476d59af2d54ba79bd2
  • MD5 696e0a3df2927dde205b3d1894677e1e
  • SHA1 b10d49e4c2809e4ea9f814fd6a0a311dad62fbe8
  • SHA512 e688abb18745843b2ee018eccfc3de0fc58eb3df39a993a2f825725739862b93950ca2f164f0734e72d64b64f94720746eff4bb6d2c8cc81eb91abeacacc63d9
  • SSDEEP 768:/JNGCURaXC8mbKyv7oAk3pfd7fIWmr/ph6KWzmgZh0HA+711t+c4qvOZNIC:XGznoAafd7gWc/pazvqRntKZNI
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral10behavioral9