Extracted

• • Target

    c041a06efb25eff8fe0ef8ec1b43b3828ad4c3489827add8e156d7a2ec2a786e

  • Size

    1.1MB

  • MD5

    f6291775008f71c57a810fb5803328d7

  • SHA1

    a8135b5c3e14002e35188f3cc5dd9e00dff21552

  • SHA256

    c041a06efb25eff8fe0ef8ec1b43b3828ad4c3489827add8e156d7a2ec2a786e

  • SHA512

    145606f3c434c5bdc2db38cf18ffdb359454cd973ff11158433a8955a845499f3a9b99f95664767e86efb75268cdea9f586fb7d9ebb64ef22c29e6fb5afed291

  • SSDEEP

    12288:GtHYDeDuDLzi5Z96Svb/nYsv/ysXEizfPxuGYjSHOL08+t2gI5tx/gHtBbtj97eG:YaSDnYsv/ysXEizf5uquL4U96RN

  Score

  10^/10

  formbookvjw0rmermrpersistenceratspywarestealertrojanworm

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Vjw0rm

    Vjw0rm is a remote access trojan written in JavaScript.

    trojanwormvjw0rm

  • Blocklisted process makes network request

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2