Extracted

• • Target

    Invoice8252752.exe

  • Size

    318KB

  • MD5

    8ea255af1117e83b0c6c4cd1f7ff4eab

  • SHA1

    4c3870aef757ca5efcdc324239a8744ed20c10b9

  • SHA256

    e6d371badc121f232f4305f3a50f0a136d1b7edbc3337414ca692c26ae41986c

  • SHA512

    9a4b185b1836683aec23e037377059d6416c204b4d71fc34942eba0f8d8091a24688d3a1a7f737459bd79ace09b601b8cd72de11616e4eef214c12f0ab54a474

  • SSDEEP

    3072:i/2HRMd/qiEcHUFFms+qCNkkiY0ndiH+Q9y+IZrToLpQwATrJd32Q3z84XvZGX:yQRM1f/0FT+k9YuSFKToVQJrJv3fXvw

  Score

  10^/10

  formbookyx5discoverypersistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Adds policy Run key to start application

    persistence

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2