Extracted

• • Target

    PURCHASING ORDER.exe

  • Size

    640KB

  • MD5

    8ae724ab3e2563c045f22b247bb503ca

  • SHA1

    b83ee3453ede32642ed99b27b726d7640e3b9f7e

  • SHA256

    6b112c998634e2a7c4b8f8442ff09f67f9e02cf6273172b856ded617a61fcafe

  • SHA512

    2b1da1732b583c3a66e0a7b35ce73a63cda90aed5beb9db965fddd75e3f1cc721bda0bb3ab06e38569a9d23dc2e1112d20a4c6ee465d42287dd06374c41df43e

  • SSDEEP

    12288:R8xa/zmcDXmbrEtQNwRxifuSuGcaCpPUKKcLP/H2xKiWmY0qSh4Gs:R8xaak0QtQNa6uS9CpUKKcLnGKiW4qpP

  Score

  10^/10

  formbookhy08discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2