Extracted

• • Target

    vbc.exe

  • Size

    226KB

  • MD5

    27b4c55d335f86868e234f8aa79ca058

  • SHA1

    1ecc8c5fefd7ad001b37078bd79d68f4331dc9ba

  • SHA256

    48fcd109b51adcad58459318c092f4b6e8e5dcca682f9d60e1592e53dbb6174b

  • SHA512

    e2c11d73be4c98dd7ddeab92898020e7bc2c9df16d99a4f2a54e4d5d5b3fbcb6c34c1869974fd43044535910756d058a761520a922dc0249ba93cfa963eec617

  • SSDEEP

    6144:QBn1XvXjPujhRD+dVfowhWJ2lBFlrggcZ:gfXjPyYVfoz0lnZKZ

  Score

  10^/10

  formbookf4caratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2