Extracted

• • Target

    22ee08b9678302f3671e7f1c6abd33866366b034faa9da27757fee2e05e23bf1.exe

  • Size

    2.0MB

  • MD5

    212d2562e0f4d53f9fe595f730f14f95

  • SHA1

    74f3d0c8ac4cb82000b4e799e3ccc080a372b88e

  • SHA256

    22ee08b9678302f3671e7f1c6abd33866366b034faa9da27757fee2e05e23bf1

  • SHA512

    826cec49775fd6c4fc5f5ebfa374a8424fd5c2258cab5d64168d3465d827c6d5d23eb0a797b12e3f1b1d5a42d6df466bf43bbe6a1566d6daabbb9f7b94b33e8d

  • SSDEEP

    49152:8fDe+fmH7RRZ1UW84VCyH+4FAGqnx+lg3jszd8u1NhSCg6Ek/A:8fDQQs3fJ/A

  Score

  10^/10

  formbookgy15credential_accessdiscoveryexecutionpersistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Formbook payload

    rat

  • Adds policy Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2