Extracted

• • Target
    MalwareBazaar.20
  • Size 28KB
  • SHA256 59d62d05f9e650108c7ded3a9760805e3d5394d4d2c7b44ad6487092356f0d2e
  • MD5 3670209822cb4c91318d37a4fab1b479
  • SHA1 8697c20f27ab079f6f1c57ed533c71a62ef4114c
  • SHA512 a9367864273992a922e42be5c182bee82ed270ea4d8fc1cff297134ade6276e0f533c38691ad6f473542ee52f70ae7accf6686a27433eaed5210a3500f7d88a0
  • SSDEEP 192:bEqYZcuW7E4xT7j8cM6RCWNuP9TdlWR+ihTr1vLRGgfPgeruM3DyeRdoKJ+YmWKw:bEqYZnatMtjlRg69cbyN5a8ejRnVJGon
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookss24persistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Adds policy Run key to start application

    persistence

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2