Extracted

• • Target

    219a330b7ae9807411d289f28169861fc748f50212ae2317278bfe155d89990f.exe

  • Size

    1.6MB

  • MD5

    686fed0af9eebb2581701d4e08e9ff0b

  • SHA1

    3c9f400ba8c6fe7f35f20bca09e59d3bb8169035

  • SHA256

    219a330b7ae9807411d289f28169861fc748f50212ae2317278bfe155d89990f

  • SHA512

    178d525f08b12ccca7c2a11f230e4bd83b74d28d17f15c13696937f57e4272aa34b0542aca6890e032ff7d4732be426ef00dcc54adceb70bd71f05cbd6d6bb00

  • SSDEEP

    49152:YAodtaG9kS2U84B+FLan9k5TRM9zlxVjZfjQq:I/B13fjQq

  Score

  10^/10

  formbookn7akcredential_accessdiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2