Extracted

• • Target
    Purchase Order_Data sheet for 20ft.js
  • Size 1.5MB
  • SHA256 331712785d2f4d9f0a25a558d3e8782652c6ec026d96c2fa67bbad0db15e941e
  • MD5 a1b0d87eb544b36839509587b52b9c5c
  • SHA1 8c0c16a7d601f1e395df018cabdcd6970db65351
  • SHA512 ff7912ce7d0e5d904d7876045c5c97621b497af2d4651dfb30a131e6eccfe4b7348bb00da6437edf967ceb0fad7987d83156fd75eb2a86e4af7d4fd365316849
  • SSDEEP 3072:VFvAzRjEkomHRDXfPm++o3UrJOfjjv0aIhA3iYg+WCH1adqEEcbThH24VmBBy/KD:HeNEVme1Xq
  • TLSH
    T19565E93CDE687C3A63B8CA2E4A9D87AD570732B33A5EEC4D14E1124C4116C51BAE527F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  m02sdiscoveryexecutionformbookpersistenceratspywarestealertrojanadwareransomware

  • Family: Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Registers new Windows logon scripts automatically executed at logon.

    persistence

  • Uses the VBS compiler for execution

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2