Extracted

• • Target
    vbc.exe
  • Size 572KB
  • SHA256 71ea65acce74b5793f509989efe2b9dee25d7700f6d52aeb07e321ad2ebe0b59
  • MD5 5215d77fe7658c57dfa558d06347cb9d
  • SHA1 bec3bc597455060365a4b52a94d6cd10bb1d8e70
  • SHA512 409a12e9201ec535d03bb250e3ae2bba23729574f1a21b31a409431c55562740869ad3465263c4b27fc3d60f719684974237ef2abac034bf631dadfad2052f0d
  • SSDEEP 12288:SqJLBMmBDlr4COKJ+JLgRSZ5KPZYPfzD:SqJFMJCOKc/KRY
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookg2fgratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2