Extracted

• • Target

    invoice.exe

  • Size

    430KB

  • MD5

    330f321f4ad980d88e42856eadef1b4d

  • SHA1

    c9d3d4d2826e772bc9ea06c000ecf308f5a391bc

  • SHA256

    4919a29a5a4c667f78fbb48036f83de599df655391011fb243c1ce5c64c64a8b

  • SHA512

    f47c477ff13c9261382d0399ebb66b85e528c93c82daaa588813bcf60459d19633113209b177b5c150629a6e6d27f4ee0eaab2028e8a762571963ff91f193e9c

  • SSDEEP

    6144:tWZAyYUcUZTABiq7lfjxsZhEhcSbj3j7ZOrVCQW80QfedQXgCUtgT:OYUcblfjxcuhc0TYs8pcQQ

  Score

  10^/10

  formbookrs26discoveryratspywarestealertrojanpersistence

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Adds policy Run key to start application

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2