Extracted

• • Target
    tmp8fhxlkeq
  • Size 1.3MB
  • SHA256 75c48a036defda95b81b0f62759558070ee9e3432f694752c6ef50ca59595d08
  • MD5 aa1b0f0dce509903f41fba4edb853579
  • SHA1 7bc9e8fcc15d4eaac148d1a95f5ffb4e4359b2fd
  • SHA512 5cedeffa6101026e17b84d58bd0cd3100dbeb2af09a5564bd7095fae52511a8634aaea68e7800999116c74c4e0c95256899d8c1d4b66f320dc634d22fd55b70d
  • SSDEEP 24576:87FHdy9OyP0Ca3WbhqMDElCdX/5JJX5vUjYh4YpYYeSh9/OH8uRiaM:IutVF9fuRc
  • TLSH
    T11355BF58C88432989DA78D4DC0FD659F37E87F4DC8A2A4BCF8197E97A73B21493012D6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwaretu90collectiondefense_evasiondiscoveryexecutionformbookratspywarestealertrojan

  • Family: Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2behavioral3