Extracted

• • Target

    ORDERLIST.bin

  • Size

    1005KB

  • MD5

    2e8f7b66c45f593718e35c6f03d2a888

  • SHA1

    08f1e682a23612bc7f1b574f14de4a2b978f0006

  • SHA256

    2ca1fd154cb8f8f7df82b11827026c30ff1bd66840a9fc7306c4a78cf7022a09

  • SHA512

    c0e1fc5d4d6a05b956d54908eb70ee43ab1fdb843079316bf2e1c9b06010f3a3d434d4dfe6dc5efaed1f156e457007c40eb6d491f4218d7cd7a1bd78772be045

  • SSDEEP

    12288:O948jvBC+llKfOsskGSSO59xneQIYTBkXFYUz3S30lQY2VGamSAQdP4:OmYnlYsLmXeQIY1kXFo3eQDVZOp

  Score

  10^/10

  formbooknr5cdiscoverypersistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2