Extracted

• • Target

    CIMB_Transfer_Advice_202410071423249.scr

  • Size

    1.0MB

  • MD5

    300ff1bc3d4844b01dfbe286cee227f1

  • SHA1

    6bf67dfb145db6bb4c69be1b0b3d3e48083ef103

  • SHA256

    7a32d719f6c21addeb0c0dde28204b36483c35af0c8d8deac909db4700e54f7d

  • SHA512

    a48ddd4457e6b7eb775bfdbc90bade4d8547798c9834f3689fb4c9bb37c37550a3ef108d0d91f1a047b047b7550a9916573f7800a0e9cb07703be6007b95a30e

  • SSDEEP

    24576:3N/BUBb+tYjBFHbpa6FI9Dh7EbQyzX1zJ54D+q0lPBzkFK:9pUlRhNan4sUX1zJ5w+JPBAK

  Score

  10^/10

  formbooko52odiscoverypersistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Adds policy Run key to start application

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2