Extracted

• • Target
    PO_CW00402902400429.exe
  • Size 1.5MB
  • SHA256 e7b39d439760b443b269a4c05aff708866ed9f6bff5e66d91b9316523a312998
  • MD5 f6b03349d643dd6a72fdc3e12fd638bd
  • SHA1 80d9f410f72e19b15b3d8434b4772cc7c7d5a05b
  • SHA512 3cd82c56b5bf2c77ab2304d91cc15f580919c882d7a22766af9bc6e437d028b98a9257b92fadb3bddf635b4f5b486ae0d850dd358e8ede892dbcbb1b25923a2b
  • SSDEEP 12288:a2rXmCLnKOtnRq47rUl2jZ7GwVdkC9bq1AaAE:1m8ttRProK7G8dkC9GHJ
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookss94credential_accessdiscoverypersistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Formbook payload

    rat

  • Adds policy Run key to start application

    persistence

  • Blocklisted process makes network request

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2