Extracted

Extracted

• • Target
    bea519bede37f69c08d5d41612b0709231242a62f6a099433c783bef5d40b02a.exe
  • Size 549KB
  • SHA256 bea519bede37f69c08d5d41612b0709231242a62f6a099433c783bef5d40b02a
  • MD5 3b8109a47ed68232b0bff1bdaf39c33a
  • SHA1 56a00c74e584b1b62c3338d45cad0932a106e9ff
  • SHA512 2e3dc37800d0397d2f40d935c59a493088446d577bb8b0f45547935603ccaab1dad65a20985afcbd1f3ef9d631247d74b7085812a9ae5556fd83bf71a13fb18c
  • SSDEEP 12288:VkkKkXdrJwKcIL0ERnQQSoX9K4KpzaC8QApCnQmxaM:1cHCQboX9KxpsQAp
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  lokibotcollectionexecutionspywarestealertrojanformbookdn03rat

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2