Extracted

• • Target
    1eaa86eac4b0e31012c5df0094bbbf2ce39a270baae540d0044de1a7f5226f93
  • Size 1.6MB
  • SHA256 ed2ac5e893ba48ab637927b1ea3092fa88f0c5ac83125d63c2bf6983f5fe9592
  • MD5 45a4e5d5a6cf73ca933df94dc0717abf
  • SHA1 17172d6433ca3efc9e0e7aadfb73820c786fa974
  • SHA512 316965afa3da625c082d24924c8079e5cf812654b166784c6341623d8e7b98a0733d6629ab2a8d9d4eaa5de1ba964cdaa4477ffb7a5740aa500b8be4a73ab85e
  • SSDEEP 49152:iAodtaG9kS2U84B+FLan9k5TRM9zl2Vj8HF9nVLn7:G/B1PHFDLn7
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookkmgediscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2