Extracted

• • Target
    PO & Company profile.vbs
  • Size 26KB
  • SHA256 062f6690032038c43431dd3f3e85ac59bea9523028dc0be04ee014ba3aa5f56f
  • MD5 f3374a03eb8a57510b43a65470464ec6
  • SHA1 182836aedf1d3c0948707cc1e86b52bb0857a8af
  • SHA512 7d9feffd7ffbaf96769bcbb19429ee6b3485a53c478e9d02373b6d437c16a71532b4b4a0886f9ba5e01fc9c99817388f572c5d962a8832f21a5b115eb5f70bde
  • SSDEEP 384:33k2uAnQynvV1sxegUDIZ2j91Rh54SqjrHLyAWDOcEGfhytg2:3U23nEXP2jthWbfLyJyPtX
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbooklm31persistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Adds policy Run key to start application

    persistence

  • Blocklisted process makes network request

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2