Extracted

• • Target

    Erzsébet - árajánlat kérése.xlsm

  • Size

    57KB

  • MD5

    49fbdfeeae6102f667899001e34cc40a

  • SHA1

    0538c187474e653f877fe6cb92cd0e4e6cf00ec6

  • SHA256

    80bc491f53143f0586753066eff8912b356258afe443f5d0f74ef9b36703225c

  • SHA512

    b1487ffbb8ba6c5b7eb33738ab65323d715a0d2f5238f65b4dfc1d65a72200fdc18b889ce952fc9e4e02535528d7b3d653680290890b525cde0b24a898d283c2

  • SSDEEP

    1536:OwCabiKWDDSlECVV/rm8h+DVxVevyhc3W74:O8flECjzm8hBvwc3M4

  Score

  10^/10

  formbookdn03executionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2