Extracted

• • Target

    3.bin

  • Size

    716KB

  • MD5

    6cfd9e4c91e40289c1336092f523fbb9

  • SHA1

    bf2f3761187cd41996565fae116392e241e2c3d4

  • SHA256

    bc85bf351d0f875cab0a1e3bd802665cdd6ed1afe837ab9bdf3d37aeac1e5fe9

  • SHA512

    eb58e3ba01e8350c74e0ba90f2a564dbc196191f3dba91519ef29eaec6530bdfa561526f8dc584d402d93fa6d50558b456264d12b420378c1026159ae7b054e9

  • SSDEEP

    12288:cj3tuU9X6XyGWHBYg/8iTCX1aZBFXXQO186Nvy6kOnPMD6RCsoP4+JW22dS8gfod:e3tLJ65WhX8iTwaZfw9xAUDC8c

  Score

  10^/10

  formbook4kxdiscoveryratspywarestealertrojanpersistence

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Adds policy Run key to start application

    persistence

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2