Extracted

• • Target
    tmpc222jj_i
  • Size 1.3MB
  • SHA256 61489fd53e391252cb169ac36d722778eaae2098138fa6191cbe590ae8645c2f
  • MD5 713e5a942fd3e43878750719ea812edd
  • SHA1 5eb264cfecaab3404b3f2738cfd13a3b86a793ba
  • SHA512 3cca35c4a42f9b47c4b4d21c738c2247b1ec4e687b42f98264438c804fb036cd451c0da0ec631f910d7c9b6116125c2c67fb66f4e6f5fd83df263f882fdbe5ed
  • SSDEEP 24576:WySOIeHUHjz4wDhoJSdtB4sTbbVBe8mEelrU9wC01IHogzJPGyIz:4V+J
  • TLSH
    T1DC55CF0195A227EF0DDF432264F95A6F5BB05EBD201A24CF77F1F216DB680058BA36A4
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwarefz49collectiondefense_evasiondiscoveryexecutionformbookratspywarestealertrojan

  • Family: Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2behavioral3