Extracted

• • Target

    MV DOOYANG TBN PARTICULARS.exe

  • Size

    259KB

  • MD5

    571c086c113946c6bede6590548a96d1

  • SHA1

    f03b3c1cf890d22df72094e3df466d141a0226b5

  • SHA256

    4a0f5f393b9b5ec51e24b1feb5ac4239ea144960d25825e1dd5f3af02858cc2c

  • SHA512

    9917251bfc52dc8ba6788aecee9a149340c30b73565598c22d28a6d1a34d5e7357a4b4812429965b1d3f58ad904dad4902d06762dcbe25adcdce83d900e27f1a

  • SSDEEP

    6144:1BnqxnIIw4bDUEDTIg826uyIM42tgpouzDPDxm:yxnIN43UHzDucgi0PDxm

  Score

  10^/10

  formbookermrpersistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Adds policy Run key to start application

    persistence

  • Blocklisted process makes network request

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2