Extracted

• • Target
    Purchase order list.exe
  • Size 1017KB
  • SHA256 da63e8bb36574c655d7d306574afbc4a67396b12cf8553b1149e0ac8560dc313
  • MD5 18dd5c3906f514d194b4e00e338e2a44
  • SHA1 2dfc0be7d26bce4bbd6dd3a930e3664e76de9ce7
  • SHA512 e7c0a61ca5256bd9a27ef3f1518904751707f675ed3c1374d42e75cbf708eed49428154aac8b98609b3fc01fe4e7f0fe3dd0353319120cd3a19354886461ee75
  • SSDEEP 12288:nLmPCfh8bqyp4hVV8E2KnYJuhEFNznsjgieOVEjvSnyDnAtrlktQB2eBoc:nLpfNN8EeHTzbnLmxlkWB2M
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbook3noppersistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Adds policy Run key to start application

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2