Extracted

• • Target

    3d93ad3d9374e100842fc9a5c683d86b.exe

  • Size

    2.1MB

  • MD5

    3d93ad3d9374e100842fc9a5c683d86b

  • SHA1

    6d84040392c2b071dd1546a85ce7c8f527d7e1b3

  • SHA256

    8ac8568934d1a0ab9a9923449bf11c0d44d97abca0bcabd60b94348642f046ac

  • SHA512

    d87baae4c95e41bf82c60c705638d010e3e6e7aa66a95adb9e4280ab2f9acf8b6f633c919f9ef4bc69bac0d700f010c2d72643aacffac4878e7855b3528e40f1

  • SSDEEP

    12288:LB9rRHQ435jKIJE/yGcn5k9BTFE1ksbRz0A7JFVTr/EJ:d9rpQ4BGcATFokMT/n8

  Score

  10^/10

  formbookoi12credential_accessdiscoverypersistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Formbook payload

    rat

  • Adds policy Run key to start application

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2