Extracted

• • Target

    e5d97a568f1962694316e3ac3f5120e1c2aae9d6c6a16f2b9cceed793b4377b4

  • Size

    2.0MB

  • MD5

    5e8e7dd95b3e592a44a3c61b7f8d91f8

  • SHA1

    d829b9e1e99087d94f527f359184f65b608190c5

  • SHA256

    8d278608d1d1c4c5b6c048020c23351e75203066af1ae1e63c5c5ac0170cd3de

  • SHA512

    a9846b798e89596da64cfeb844a5dcb3eefa983972cc4433cb6861464a386900a9035428187e5ae4e8b666a70df7c147f48884c512ee5823bcd1275072fc8d60

  • SSDEEP

    49152:tl2eQMj254Xra+qk6okjyjxKtyEAqVG13lwUWQdHt:76euw

  Score

  10^/10

  formbookkmgecredential_accessdiscoveryexecutionpersistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2