Extracted

• • Target

    02500b9058612028c5667bfd9302d81184689fcb88eb5500902d39baec246fa0.vbe

  • Size

    785KB

  • MD5

    83ef588dc92a85ef93d055290393a07d

  • SHA1

    c7fa54bb9f8d5467137197b8e344b95d2e1f4430

  • SHA256

    02500b9058612028c5667bfd9302d81184689fcb88eb5500902d39baec246fa0

  • SHA512

    eb1adad95a1269dd49e202e966b67a8d3867055c1462687596fa47dd133929544a295e2e3b04f8bfe3c87690d241f780f4a1ad75718e462b468007e3e8dd0827

  • SSDEEP

    12288:WEPXAjdRFEYFexVioNs4tkt4pNVZUAZTklPuAGPm1LEKIV8rrq9bbeQnhG4Shmo9:nPXApEY0ioCUpNV+unrKs869FE5hmo9

  Score

  10^/10

  formbookde94discoveryratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Blocklisted process makes network request

  • Suspicious use of SetThreadContext

  behavioral1behavioral2