Extracted

• • Target
    payment-order90094983.exe
  • Size 894KB
  • SHA256 1d7754c8cc8eb7df3bd429fe9806b85f7f6fbd768ff59948a1772eace6dec77c
  • MD5 bad0cd306914d3086f8f4ebb225efa9d
  • SHA1 b4743c8801561f5918cc2cb7dabe9cf85f4eb0ec
  • SHA512 35609b310a174d4ac3dc3cee729709b200186b37d2d0fa081391c1a5d0b964a6ece43cf739f4ddd2511ec41bf1ba83b7c69906914cc3dd4c904f1291c16e2e01
  • SSDEEP 12288:RfDCdicl4IfmVIhQbZgU1Hp40gSqHx5NBsZp9XLDvCRzCwv4xvzc2PgMlv87y4v0:RciUhNhE2694zCsEvzvPgCCy4af
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookhd05executionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2