Extracted

• • Target

    06082024_0319_05082024_00253390 pjg.exe

  • Size

    2.7MB

  • MD5

    5ef32b214d2f96f8490a1bc80cd69b8c

  • SHA1

    bf5d22d99cb7a904ab2747e24dc443ccd97f2527

  • SHA256

    7f75fa52a4033aafb55eec07a5a901e357baa76ef4c1c6e109c7f5c4dd99c9eb

  • SHA512

    34d9eb853da9250e83340dd9e364dbe5c2c7e0b180296a012e899180e52bde781282dfe081f946c8da0e1eb91d9a496358fe9902eac58c3f0c249ea3bdba5058

  • SSDEEP

    24576:gLn/zhq30bbdI6Xa4KtHl3MXX1s34FMV7I:gLn7h9PCQRKd0X1A4F5

  Score

  10^/10

  formbookkmgecredential_accessdiscoveryevasionexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Uses the VBS compiler for execution

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral1behavioral2