Extracted

• • Target

    fbgoodforsweetgirlvoiceniceforhearsagirlscute.hta

  • Size

    15KB

  • MD5

    520f17f7af435832e77ae66293b4d1ca

  • SHA1

    6ab857b3d3bff5a1f269646c5dbeef0d23c8005c

  • SHA256

    d90c2332eb0e2dd1c54e8ce03e559230bb13848df371e0d76ca4507238463c35

  • SHA512

    d9b97f6a54ec964a741647461c412e67efc80d912d8691c49799f24e83f263b6095b0779ef613265da7a249f86d7a195708ff813a04c7e6c9ee87ea13b319348

  • SSDEEP

    96:rjCYo4DxCYoJUDzzUOPtQf04kcFbXYCYoNCYo4D6CYoM+:3o4DRoiDzzUdTNXooto4DCo/

  Score

  10^/10

  defense_evasiondiscoveryexecutionformbookb101ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Blocklisted process makes network request

  • Evasion via Device Credential Deployment

    defense_evasionexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2