Extracted

• • Target

    HSBC Payment Advice.img.exe

  • Size

    720KB

  • MD5

    271c1d8e6411be19170021ce4a896359

  • SHA1

    0948954a5aba126505fce12b4336f3f02ed14f5b

  • SHA256

    0effded7966d1959e7451e0a68256df8eb5c320e9721b3f4b5e2d7aace8792cf

  • SHA512

    d2f887b96644707aa2e453e263f2b6ec0844801a483ad0888f2c3c6d83db01a2f3bb4ebb97ea2fa0ad8c9faa005d5aaca81c24b94ef253677cb3e50517a39f29

  • SSDEEP

    12288:00XyD3HH3DI+F0dlaflXIcF4kc+4IXQtYJvUKOzC3KyAxWkR:ZXyjH3DIPdMzak14Ig6JvUKMPywN

  Score

  10^/10

  formbookmw62executionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2