Extracted

• • Target

    1eaa86eac4b0e31012c5df0094bbbf2ce39a270baae540d0044de1a7f5226f93

  • Size

    1.6MB

  • MD5

    45a4e5d5a6cf73ca933df94dc0717abf

  • SHA1

    17172d6433ca3efc9e0e7aadfb73820c786fa974

  • SHA256

    ed2ac5e893ba48ab637927b1ea3092fa88f0c5ac83125d63c2bf6983f5fe9592

  • SHA512

    316965afa3da625c082d24924c8079e5cf812654b166784c6341623d8e7b98a0733d6629ab2a8d9d4eaa5de1ba964cdaa4477ffb7a5740aa500b8be4a73ab85e

  • SSDEEP

    49152:iAodtaG9kS2U84B+FLan9k5TRM9zl2Vj8HF9nVLn7:G/B1PHFDLn7

  Score

  10^/10

  formbookkmgediscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2