Extracted

• • Target
    02500b9058612028c5667bfd9302d81184689fcb88eb5500902d39baec246fa0.vbe
  • Size 785KB
  • SHA256 02500b9058612028c5667bfd9302d81184689fcb88eb5500902d39baec246fa0
  • MD5 83ef588dc92a85ef93d055290393a07d
  • SHA1 c7fa54bb9f8d5467137197b8e344b95d2e1f4430
  • SHA512 eb1adad95a1269dd49e202e966b67a8d3867055c1462687596fa47dd133929544a295e2e3b04f8bfe3c87690d241f780f4a1ad75718e462b468007e3e8dd0827
  • SSDEEP 12288:WEPXAjdRFEYFexVioNs4tkt4pNVZUAZTklPuAGPm1LEKIV8rrq9bbeQnhG4Shmo9:nPXApEY0ioCUpNV+unrKs869FE5hmo9
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookde94discoveryratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Blocklisted process makes network request

  • Suspicious use of SetThreadContext

  behavioral1behavioral2