Extracted

• • Target

    vbc.exe

  • Size

    572KB

  • MD5

    5215d77fe7658c57dfa558d06347cb9d

  • SHA1

    bec3bc597455060365a4b52a94d6cd10bb1d8e70

  • SHA256

    71ea65acce74b5793f509989efe2b9dee25d7700f6d52aeb07e321ad2ebe0b59

  • SHA512

    409a12e9201ec535d03bb250e3ae2bba23729574f1a21b31a409431c55562740869ad3465263c4b27fc3d60f719684974237ef2abac034bf631dadfad2052f0d

  • SSDEEP

    12288:SqJLBMmBDlr4COKJ+JLgRSZ5KPZYPfzD:SqJFMJCOKc/KRY

  Score

  10^/10

  formbookg2fgratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2