Extracted

• • Target
    PO_#2576.exe
  • Size 393KB
  • SHA256 65a02f6b451bb5ccf5d443b7976da84cb80812e24a909d1038423bfe5ac5e2b8
  • MD5 03afc2c56794a27dd1d293ee657925c8
  • SHA1 e62ceaf311536d1f66c9fea2d269e678c44c46ae
  • SHA512 0042d776c26d92bad30ec8ddc0cbd14a497ffdb8fa09b4cf3940419f7642ac4b5d079c680fba41dec10c4b722fb48872ddd26ecd034ce53a64bda3948332e795
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookratspywarestealertrojanpersistence

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook Payload

    rat

  • Adds policy Run key to start application

    persistence

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2