Extracted

• • Target

    Documento di richiesta di preventivo NR_531 28 05 24.exe

  • Size

    616KB

  • MD5

    11a0cfd6b18f2973e0e8e6681191617b

  • SHA1

    2f9ac77721ddb3a5f5e1e0b38e9ce0a71dc38ad2

  • SHA256

    771345cacf6009f18aee571afcba07b7d20f61e411c23f15a1d2b87803c68bee

  • SHA512

    641f4d3ee58ef0b702c4cf1db2819e2aae87839ade3ca3ca8e39cf4d5ee918555aeb17ef4dd6a37b8119078789492687e49650b196a60d4200389175b1fa09b6

  • SSDEEP

    12288:LCCVt31vOeMY09tjQVMmYJSOmBk9Io9U+QhckM+:r7vtMY09RkMmYJSjBkbRQ

  Score

  10^/10

  formbookpz12executionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2