Extracted

• • Target

    JTM300724IU.vbe

  • Size

    3.1MB

  • MD5

    c845430ea08040d92adc7e9e5870143e

  • SHA1

    0715a93a9902b41b72ff8beaa4f371782c40aaab

  • SHA256

    b9944dc05df7b7a10e4326dfb17a10e7c174238cbebf8bea02091a839cc0f0f0

  • SHA512

    d517d1b9c4cca21f3bdc295133795a9265d44ab436f38bf44f035ca58888f6a14cc5e063fe4ccf20081b9592088bbc56df2b70efdceb6c2450872e194e0bfded

  • SSDEEP

    24576:IQ3d8+MwrXBn6Dc0FEJZF1Nx+bFOoWV+xzN1ewkqlK/4VF7m66W0aGIC3G0zr8lv:J50mJTow+xn3S4OWdbCgTOGN

  Score

  10^/10

  formbookde94discoveryratspywarestealertrojancredential_accesspersistence

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Formbook payload

    rat

  • Adds policy Run key to start application

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2