Extracted

• • Target

    2d29191fb5dd27ba947a5c7adfaaa5cc643bf7475e37c1d7825f4b7bf02e93ed

  • Size

    1.4MB

  • MD5

    bccb4486f1e982d371742a1b178f096b

  • SHA1

    5cb21784a1174c30f723b3f6bbf3f775292118aa

  • SHA256

    8e494fa1ea9ae24f5261f0c38c8aaae8fa2566ca08f95287f3c326eaa98c0e09

  • SHA512

    29d53241a30a9fb347efbd114f7890925d840f46df10ed801d016436a11e34ad4abd3514a8442501ff7812606256cd35a5e231e2292cb6029a6f0fbf27a9c191

  • SSDEEP

    12288:Xm5tWd+qExpizJ10dJYHOZ8iyQvR7OAsRluo+KMF7z:M/xpizsdJtbPKvRUnKE7z

  Score

  10^/10

  formbookkmgecredential_accessdiscoveryevasionexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Uses the VBS compiler for execution

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral1behavioral2