Extracted

• • Target

    f691fb2c2b5183a496711a5b78b575ce.hta

  • Size

    115KB

  • MD5

    f691fb2c2b5183a496711a5b78b575ce

  • SHA1

    ce9603dd85d843e4fd9fa66843f46ca5ece4e260

  • SHA256

    1c7d8ace58257e970e2f7738886c596d8189f85cef9127dba9b324735f506821

  • SHA512

    ce1e7a6b64b0d14d1d42ddf134d5db74aa8a17c6945c32f17829fbce7f309bd8f34ac1d750548c66c1cf4dcbd234531c6f57e354ac5f605331d39a57d9bb11ba

  • SSDEEP

    96:Ea+M7iHLlFPiJSHLqFPiJGkpmfORxcHLoHLDFPiJTHLQcAT:Ea+QiHJFPlHOFPhLHsHfFPmHcT

  Score

  10^/10

  formbookj62tdefense_evasiondiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Evasion via Device Credential Deployment

    defense_evasionexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2