Extracted

• • Target
    Payment Confirmation Receipt.exe
  • Size 526KB
  • SHA256 22722e6e6da1ce062caad041e121b74af35678e455cfc0de59c3ea1eeb469520
  • MD5 a21e01bef23ec4f2f0ad9d2e284d5985
  • SHA1 0fa02ff978cc75540c0ee2dca006e4a66ce9d5c3
  • SHA512 4f4e4fe7a13107a17ea8228b609cfc1f3e20cce308db485fcdb891bbde1c37e158a0d9f6ac8f3a0ccf2bbf1eeceeeac5903dab18944bfc5677f3c354586ba3af
  • MD5 SHA1 SHA512

  Score

  10^/10

  rattrojanspywarestealerformbookpersistence

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook Payload

    rat

  • Adds policy Run key to start application

    persistence

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2