Extracted

• • Target

    teklif.exe

  • Size

    378KB

  • MD5

    9f5f0a9318f01aba5f2e413cf55f30ee

  • SHA1

    2893ad78ba028cd19eec0634babf210e86b2b3c5

  • SHA256

    3b098abf608b9def35a0cabf2e548dfe01d4f575f6406770be29a25439785978

  • SHA512

    05695b9d5b70c758069d17386910b6c9a70a852557e7dc03f4827d923ef6680c81a24bad662e04cf3f3179d548fa4ed711355ce2b12f703b675da9f0fae58fc8

  • SSDEEP

    6144:ryO/Zh4o9pb4K0gUjJfeanDlgy+3IvVfgupuW9hioiYnWcEzkIdUND1tUabGgxP0:rBZh4ebmjpegJ+CVfguPibk/Nxtnagx8

  Score

  10^/10

  formbookrs26discoveryratspywarestealertrojancredential_accesspersistence

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Formbook payload

    rat

  • Adds policy Run key to start application

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2