Extracted

• • Target
    Supplier Compliance Purchase order PO 2135850 QTNIU81408875 20240215.exe
  • Size 607KB
  • SHA256 8d802f0a6cf29072e9d1e038384ca8ab28efe59d054bff97d0fa799a7b71b65f
  • MD5 fcaa494bd1ccbbb063a75e74fb63b47c
  • SHA1 6a145cdec95c7427bba1f2a03019b1bf79510980
  • SHA512 c24b45e8abcd5f6411220b9bc3d1ecff618d7d220e7947ab922d318f4e0fefcac5e7d18d94dbc7950f07172720ca0a277a999e6e4b3d3faa167368e7b0bed7c1
  • SSDEEP 12288:fBMrJB3v3G42hgCqQGLAs/zJGqjOn9/x6Xs:fBYB3vBwj6As/dFj2pV
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookpz08ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2