General
- Target dc56b2dc980c659e1c12107e94007a3ae99f9d4d555da181921e255c09b1bf16.zip
- Size 1.4MB
- Sample260708-la19jsdx61
- SHA256 dc56b2dc980c659e1c12107e94007a3ae99f9d4d555da181921e255c09b1bf16
Score
10/10
Malware Config
Targets
-
- Target Müqavilə 202609427-001.js
- Size 2.0MB
- SHA256 6a7f66a79c78fb1d836b726cf01175e52d83aa4b987c5ef38b0df4eaf38b22c2
Score10/10-
Family: Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Suspicious use of SetThreadContext