Extracted

• • Target

    Doc_0323211.exe

  • Size

    1.5MB

  • MD5

    207e1c712597de0900f79e262f59d632

  • SHA1

    c38d153841d5d05a10ff2e55e8de6753caae978f

  • SHA256

    48d22944fdf7cf66fd1423b6ab2dd0143d96b4db7915e088088b8f826d46b000

  • SHA512

    0dd72b044bd2a79a5a55c1a11f7523862f6139ca45e8809e0add0f3fc3e791215d8e634d364ffed7e21337dad9b791dd24905d408a9e62e7eeb465e7f0e4596c

  • SSDEEP

    24576:vAHnh+eWsN3skA4RV1Hom2KXMmHalWKkowX38bOC+dfJvcyPUlO85E5:Sh+ZkldoPK8YaYSwX2z+dfJvcyTF

  Score

  10^/10

  formbook3nopdiscoveryratspywarestealertrojanpersistence

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Adds policy Run key to start application

    persistence

  • Deletes itself

  • Drops startup file

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2