Extracted

• • Target
    Documento di bonifico bancario intesa Sanpaola 20240613 EUR23750.exe
  • Size 628KB
  • SHA256 e10280c91dc1fb46756d9473163eec9052b8c8a352955d0f21a24246da054ba2
  • MD5 6b799c2e76b37bf96ef35ba8580f0bfc
  • SHA1 b710a5aa6385f9424c37c944ef27d10ef99df97f
  • SHA512 3d24d60ddf69dfe6c6124df627dadcb833d8339e59b446cf44a9ecf222d36e58e3d222c8b8f1937554236a0d6121d3fb0d423160ea473a5cd412c8aecac92823
  • SSDEEP 12288:3fGyCK2xrOonraIEGL78bDS8k67E7KJIojZKBZnU02gvPQ3WEF00QiHM:uyC5raI9L+DS8jkoVgT2KPQ3B9
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookpz12executionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2