Extracted

• • Target
    3e8bac2f692d7ec30b435f1555ed080ca79aa191fcf9f32dad8658243d3fcebe.cmd
  • Size 6KB
  • SHA256 3e8bac2f692d7ec30b435f1555ed080ca79aa191fcf9f32dad8658243d3fcebe
  • MD5 258ffbda1b464ed86e65e5ae803f96d2
  • SHA1 d338e8f630c6839ff7f832605ec2aa3c78d4e865
  • SHA512 2fa183c88815f293fb3a5b5a03977250dcd6ac72c586d7028677d1137cd6b20f92adfb76880886319b57fe496c6c146c4e5c30f4e7104647e89a5be976683bd5
  • SSDEEP 192:T6Ix3c1+Dt0yCSKUQC7f7C5mUGBxgxvxC:T6xnXK76mxBuC
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  executionformbookguloaderdd01downloaderpersistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • Formbook payload

    rat

  • Adds policy Run key to start application

    persistence

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2