Extracted

• • Target

    Arrival Notice_AWB 4560943391_PDF.vbs

  • Size

    29KB

  • MD5

    592e05d52785ac7ce91bedee1bed070a

  • SHA1

    fd7c461e71a467deaff4ef320482685347077943

  • SHA256

    ff3261173380df6010b5f2fec463df92180220c8ae6631637937b097b73af3f1

  • SHA512

    def9b1a31ccaa1942d7e0b0de4949bc94216aaf17622ec2de9c90b30e9cf50ae658da07e428985ae5a0aed60f9913937ed5fce5747d0ae61703894afbf3dc9c4

  • SSDEEP

    384:YzMKK76JtZpa/CQnG5daT7K5NV3mMEMRtkRExJ:YzMKHJtZpa/lnZT2NxmMzk6

  Score

  10^/10

  discoveryformbooksy52credential_accesspersistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Formbook payload

    rat

  • Adds policy Run key to start application

    persistence

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2behavioral3