Extracted

Extracted

• • Target

    Random Stealer.zip

  • Size

    488KB

  • MD5

    84c51e64742763fccae4fb750aebc178

  • SHA1

    18f65a7f766540a43e366cc8e7fdc69020bc37ca

  • SHA256

    b2989e3951250607a07156409b221cec2e2ba984c5f285a800cddb7399066b2f

  • SHA512

    6d73eb57eabdd679a232d22ec8bfa25e49d4d42985db42f1e4cde86a08cb28768aacc2ee0338feb46c85df47bea17d6fb4dfe8c86b5552663b621752758cf7d3

  • SSDEEP

    12288:Cehpo4pS6lMrIzRKq2Hx9oq8PsFg5EUo3gLVuBYDjJqZQ:Ce7oRrINAR9HXP3gJq6jJqy

  Score

  1^/10
  behavioral1

• • Target

    795af0703ab2ab7cfcfcc38449e7da1a20967be437e5877ee27da317b3991357.exe

  • Size

    512KB

  • MD5

    cff39149d540e851536383f64d5f5568

  • SHA1

    2cd49c6f28ecea254e22a75e3e77092a67d26774

  • SHA256

    795af0703ab2ab7cfcfcc38449e7da1a20967be437e5877ee27da317b3991357

  • SHA512

    0f3eb77eb9396ec5ec63fc166e12167bf651e433b5c7831935ed2c965eed85b94b9893e6d20d207473f126b273f60c4b6378859b85613cc630acd7c7b70a6ba6

  • SSDEEP

    12288:UidJS4V9ulMb8Z6j2B0TM4kQhrLO9rAq7BH7Q4a2Y4tS87W:5ScN4ZsvTM4DhXfIBUa17W

  Score

  10^/10

  formbooklokibotdn03collectionexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral2