Extracted

Extracted

• • Target

    795af0703ab2ab7cfcfcc38449e7da1a20967be437e5877ee27da317b3991357.exe

  • Size

    512KB

  • MD5

    cff39149d540e851536383f64d5f5568

  • SHA1

    2cd49c6f28ecea254e22a75e3e77092a67d26774

  • SHA256

    795af0703ab2ab7cfcfcc38449e7da1a20967be437e5877ee27da317b3991357

  • SHA512

    0f3eb77eb9396ec5ec63fc166e12167bf651e433b5c7831935ed2c965eed85b94b9893e6d20d207473f126b273f60c4b6378859b85613cc630acd7c7b70a6ba6

  • SSDEEP

    12288:UidJS4V9ulMb8Z6j2B0TM4kQhrLO9rAq7BH7Q4a2Y4tS87W:5ScN4ZsvTM4DhXfIBUa17W

  Score

  10^/10

  lokibotcollectionexecutionspywarestealertrojanformbookdn03rat

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2