Extracted

• • Target

    vbc.exe

  • Size

    812KB

  • MD5

    4f57c474b77a208ee4d212894b3512d2

  • SHA1

    41d369bc50e40fc80054e215d3b2ff44be10c08e

  • SHA256

    abbc3fed4f82fe9afe22de485ec621e13bb0890d633e9c57ba5ebb2fe66b7159

  • SHA512

    0d7efaba27a0564ed224edc0fba642e93676d3c2c561a58887ca925870bc09eb1dda9b9617428247761386aff630ad052a832f698b054d434b82456e80707d25

  • SSDEEP

    24576:0EXVZ9a++LeZLGjl66eaCku6e4XCi/EJq9:330LDJUaCG1wJq

  Score

  10^/10

  formbookg2fgratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2