Extracted

• • Target

    8aaf453b110fa7065e947c3ce62adba79a22b32894a5779bc2aa9cfd87d6df1c

  • Size

    895KB

  • MD5

    eaa0d0183335da6eaee3680ec0f11209

  • SHA1

    d6506fa84779f2fb61b86a68c948f44f5abbee12

  • SHA256

    8aaf453b110fa7065e947c3ce62adba79a22b32894a5779bc2aa9cfd87d6df1c

  • SHA512

    61af0c623e36894abbfc6ed557c3a51d851c82273dbefeb186ee677b6eb5a800206500c27abbdaeea047119cf009e7c368c041bac4e98e06b51da09820c0f113

  • SSDEEP

    12288:vxykgiEyf9c7MWYdDBYSv+FBkUQExkZ1DF+yNgeW/lWtFB4a:jEMc7MWiAu/J8Wma

  Score

  10^/10

  formbookvjw0rmermrpersistenceratspywarestealertrojanworm

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Vjw0rm

    Vjw0rm is a remote access trojan written in JavaScript.

    trojanwormvjw0rm

  • Adds policy Run key to start application

    persistence

  • Blocklisted process makes network request

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2