Extracted

• • Target
    order-payment094093.exe
  • Size 760KB
  • SHA256 2ece30c08f63f4fdc4d7326b39aa0066938163811e35d1aef6ddd2e0fada475f
  • MD5 91592318966139c15e0171f341882fc8
  • SHA1 a6689f85a42ce934c3e96a9088f67c48e2e1fe83
  • SHA512 abfd94393776b2fc7aa418f66487813a78c18b4704a3e9fd15d0ae99f9b8a28ee7dbe28edaff425a7f5a85005b324262e88a638caa098abc2f4e7fc4e8e44d99
  • SSDEEP 12288:s8ImEuiETpbmqOwYG0JHK9Do7Uw82OpdYL445DR8jIQpOQgMUA23RzD1Kl4Ev5kR:s8I+b9CG0JHKG718izDa+x
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookhd05executionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2