Extracted

• • Target
    Payment Copy USD 32,619.vbs
  • Size 25KB
  • SHA256 dbc86ad2a8b867c09e326e4740a9ba339b35aeb46f8edc79846ff4a30330e352
  • MD5 fb2c2f42fef4672544b8b5b6bf96d5fb
  • SHA1 a95aa7e489d47b0ad28c277ec353a9402bd95f83
  • SHA512 c97d16fca823e4b78c988f9177fa58d0700c96996ed44d22b189141410a46f08fdd1bc69de3ea9155d91a22cf03d2831991fc68b6121b68d8424a6977fd2deb2
  • SSDEEP 768:KTH21BEQwdfDRH8QstbnOO9sE5ODvkzMLa:u21BTwd18bnF9siODvkzMm
  • TLSH
    T1C5C23F164809BBB0D92935D5B74BB017A9D003A57BFB694A398FF5C83B367108BC1CA7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasionexecutionme26discoveryformbookratspywarestealertrojan

  • Family: Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2