Extracted

• • Target
    Employee Perfomance Record.vbs
  • Size 1.1MB
  • SHA256 71bfeeb8ef35de17f04b4d6d1b101a28d687341049957f1569f8b147cdc18639
  • MD5 5576287e8200b5775576625055a50643
  • SHA1 595f5625c9b606f2a9e7ade3a2da9e45c8611760
  • SHA512 0dec2210dcbebd5c82293acce1657a1e9ed2da8cbb6dba997839702f363e10d405b7018a41c09c22906361eb8102b6583c386313d76eb552fca666bb334a1e93
  • SSDEEP 12288:s31cvBzbU01qal638iNX3iTMgmuYtWN/ZgMiQPeRjkT:sYz64+2Sj+
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookty31persistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Adds policy Run key to start application

    persistence

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2