Extracted

• • Target
    RFQ#10112023Q4.exe
  • Size 733KB
  • SHA256 943a21a3e37c9d1a350da6edd3487c05d2e77e960f55dd647928021e3bc57ce2
  • MD5 a544243f6002da4d5d9f632db7febc1d
  • SHA1 40342e072b03b4bdaa0a0ff25f8024f4fa79740c
  • SHA512 42c13fd22bcfdaf94a965917e8ab8b58ba72dea46e2afc8463408154172b9ed7555a512dd9aaabe97deaefea68d36904948453a3de52f045999da535063531d2
  • SSDEEP 12288:fg7ChtcY/YLLEmmmmmmmmrxjri07rnG2oeRrAxxBwNzyj+nYphoW5f6EuoiCd6wg:fg7C3c69tr1zcAY6Nz3YPoW5f6nOd6wg
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookmw62executionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2