Extracted

• • Target

    41f341ae994cf53488e0a96a6a531c9ef26c31ad763b7f858b278657051be31d.exe

  • Size

    532KB

  • MD5

    b2f556607df50936eb1c0664034427ba

  • SHA1

    7ca4894a3804e721e85d31941bec38170099226e

  • SHA256

    41f341ae994cf53488e0a96a6a531c9ef26c31ad763b7f858b278657051be31d

  • SHA512

    a1ded171b38c3e5a37dba096e8c04b19c7cd3e46587b7681c00df2baad1e28a2ac917857e0c59de7448ed353383dc6b75c4f2cd93804028e05223bada11b471a

  • SSDEEP

    6144:VaUDG3Kp1D6VEJD6LpypZ5xw6ZzzyJ9VecftKGjiqG4ErnbST6n+lDAAG8:VaUDd76VEt6QpZ5x+ltBmqG4ErmdAAr

  Score

  10^/10

  formbook73dcagilenetdiscoveryratspywarestealertrojanpersistence

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Obfuscated with Agile.Net obfuscator

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2