Extracted

• • Target
    JTM300724IU.vbe
  • Size 3.1MB
  • SHA256 b9944dc05df7b7a10e4326dfb17a10e7c174238cbebf8bea02091a839cc0f0f0
  • MD5 c845430ea08040d92adc7e9e5870143e
  • SHA1 0715a93a9902b41b72ff8beaa4f371782c40aaab
  • SHA512 d517d1b9c4cca21f3bdc295133795a9265d44ab436f38bf44f035ca58888f6a14cc5e063fe4ccf20081b9592088bbc56df2b70efdceb6c2450872e194e0bfded
  • SSDEEP 24576:IQ3d8+MwrXBn6Dc0FEJZF1Nx+bFOoWV+xzN1ewkqlK/4VF7m66W0aGIC3G0zr8lv:J50mJTow+xn3S4OWdbCgTOGN
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookde94discoveryratspywarestealertrojancredential_accesspersistence

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Formbook payload

    rat

  • Adds policy Run key to start application

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2