Extracted

• • Target

    FORMBOOK.bin

  • Size

    1.4MB

  • MD5

    f2b788dd73b7ead8f3721782f2034fe4

  • SHA1

    f6dc7ba2b002c430f5693efdc79123f7e519bcb8

  • SHA256

    3c011d08f75514a4f4bcdd02314b903c546ad8f16186541f8f79661744100e5b

  • SHA512

    a6c0ace122fdc9897666a5520934b22523a53a2d2d0e1f586b3b8600a695d7f2f4327243e030934c126717b12cea534123d1cea47f9507c4241d1c2e31a16bc5

  • SSDEEP

    24576:ugZYp/WKU61KnS/IHqjQt6LBknxzqx2e4ZTq+9TrLZ7BO+m/7gnM:uQY5bdIJH6Umkx0kZR9y+q7gnM

  Score

  10^/10

  formbookoldiscoveryevasionpersistenceprivilege_escalationratspywarestealertrojanupx

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • UAC bypass

    evasiontrojan

  • Formbook payload

    rat

  • Adds policy Run key to start application

    persistence

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2