Extracted

• • Target
    Arrival Notice_AWB 4560943391.vbe
  • Size 17KB
  • SHA256 5345c78a28cb770a6742f203db63b35f7d0d1ad6e63c1f0780e9c8e21153ebc4
  • MD5 93acfcb0399f16bd4f025265ca8f7f2f
  • SHA1 bc1ff10271f640e05fea062bfd519997265e40d2
  • SHA512 198a519ec3195b1fd061ca80f747eb132fbfe403c01c14513e3b00982705eaf12930cda09e8252149cdb0a8eecb3ef4a55fdde483ed7f2c5e7991766ab181cc3
  • SSDEEP 192:1EqYZckc8r8AykqpgwYnFtuH9zYJpAC1id5Av+aiPTVqS1fUVVn2nkYW:1EqYZXd8jfiuH9U3HmRAj
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookss24persistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Adds policy Run key to start application

    persistence

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2