Extracted

• • Target
    f691fb2c2b5183a496711a5b78b575ce.hta
  • Size 115KB
  • SHA256 1c7d8ace58257e970e2f7738886c596d8189f85cef9127dba9b324735f506821
  • MD5 f691fb2c2b5183a496711a5b78b575ce
  • SHA1 ce9603dd85d843e4fd9fa66843f46ca5ece4e260
  • SHA512 ce1e7a6b64b0d14d1d42ddf134d5db74aa8a17c6945c32f17829fbce7f309bd8f34ac1d750548c66c1cf4dcbd234531c6f57e354ac5f605331d39a57d9bb11ba
  • SSDEEP 96:Ea+M7iHLlFPiJSHLqFPiJGkpmfORxcHLoHLDFPiJTHLQcAT:Ea+QiHJFPlHOFPhLHsHfFPmHcT
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookj62tdefense_evasiondiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Evasion via Device Credential Deployment

    defense_evasionexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2