Extracted

• • Target
    OCEAN GEMSTONE - VSL PARTICULARS.exe
  • Size 467KB
  • SHA256 f682321268a01d4d9bdf0e5bb399a0bae6f414c9a2df33e78bcbd06883b652e3
  • MD5 b20b2d3e307a66544d9cadcbd088d505
  • SHA1 06ff804d0463177d1db5c54b0e569a95981c9e30
  • SHA512 56fa60597206d55d179cbb3706db738401dceacc6c784e340b7436ae491ef024ccde072c0a8dde2ae0a967c879c319c40e8f602bc8b30a5440d7c4f6a96993d0
  • SSDEEP 6144:mzggUa8MG36Zd1pkVbbJ2wDA9nl71vZkdbXMBkRhIkSa8jxDUrJLwvVhbfJzsct3:YgRa8M/p+gn9nedzMg6XVVF
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookermrpersistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Adds policy Run key to start application

    persistence

  • Blocklisted process makes network request

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2