Extracted

• • Target

    VBshqUbZtSxUibM.exe

  • Size

    605KB

  • MD5

    5219b5632bdd4d2bf00ca0405660a8cd

  • SHA1

    118b516281a7f9d07e23014611e3a0c5148ba2d6

  • SHA256

    6ce77c20aa2bb6bd48fe6255c91a4167fd81215ed4f4fec78c7387ef2247ae7b

  • SHA512

    998748303f20e88d0239cb7cf5fe8ce055c64c27085d129f174f10705bb9ce2cb838b59da7bed922fe069e03624dffb7306f482966e5bdb2df6481f6c7b6746f

  • SSDEEP

    12288:lkjnD7Oh7Ch0pUCxtrqeZx1Kufvye6vvc3JZgPeAp0:anD7OhM0nx1t/KufvyeOwgb

  Score

  10^/10

  formbooksx01discoveryexecutionratspywarestealertrojanpersistence

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Adds policy Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2