Extracted

• • Target

    8e23f17a28191c04596391464d43870c.exe

  • Size

    2.1MB

  • MD5

    8e23f17a28191c04596391464d43870c

  • SHA1

    91e7b1e075aaf6ad3ce2fea102d4a31dea2e446e

  • SHA256

    0e4890952f2506c3cd0124d53fa0c39f2cdaf432c2be5f3ac6257793013e618b

  • SHA512

    bf9e5cee8ae9f612e3204d8343cdf11998b304673c7ecae1682de999b55d58b5632e2bff8b9893c284c1fa9cd1da618e9c3e0033214319bf1dda91b0a8f6211f

  • SSDEEP

    49152:xfDe+fmH7RRZ1UW84VCyH+4FAGqnx+lg3jszH8u1BbSCg3E16su:xfDQQsNJT16su

  Score

  10^/10

  formbookkmgecredential_accessdiscoveryexecutionpersistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2