Extracted

• • Target
    65bb56083f056194df1a8a437b283622c1e6f48079d4bfa2ef85f0ce730c2476
  • Size 524KB
  • SHA256 65bb56083f056194df1a8a437b283622c1e6f48079d4bfa2ef85f0ce730c2476
  • MD5 5f7b8e5688a8bd12c5d631b4766938ab
  • SHA1 bce60733122e61b7b90fd15e3a02de73038b8164
  • SHA512 c95d0d0d5978fe6a0c49243ea66e05d5db3876af9c40e4dfe5c4cfa7bc1da1fe5d8c4de63b132f9ab9e30d96c186c8f98901611b7fcc4554bd78316c40e01fee
  • SSDEEP 12288:/dvbSMVGZbczjAbeyhIT6T6fPaf37ZPf:1TSMVGZbczjAbNhIT6T6A3
  • TLSH
    T112B4F8005721F4A1DED4CAB16B2865DCC9735C364C3BB9AFB0933FA68E7295B43B6601
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwaresicollectiondiscoveryformbookpersistenceratspywarestealertrojan

  • Family: Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Adds policy Run key to start application

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1