Extracted

• • Target

    vz7lgfephbs.exe

  • Size

    454KB

  • MD5

    78556723d290bbbeb1ed8c761861f8f8

  • SHA1

    8eaad367886c44e90962bc5c23ecdb16761031f1

  • SHA256

    1abe9c17071932ed40d00325752b433b244fd2410bb88d8fb2d194a2e5e3059e

  • SHA512

    0f17a1cc369ffc92b5a82e50e42edcc2a10736c838ae4cb12a9eeb46009ef7b744e7c92e52bb79a39506918df58545454fce734bbbeb676e48ddef27e4ed35c5

  • SSDEEP

    12288:39vAtRe9JF3Z7uSU2mgLb67ioQwL3eHjJS:3it4h9bQi8L2jJ

  Score

  10^/10

  formbooksupportdiscoveryratspywarestealertrojancredential_accesspersistence

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Formbook payload

    rat

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2