Extracted

• • Target
    PURCHASING ORDER.exe
  • Size 640KB
  • SHA256 6b112c998634e2a7c4b8f8442ff09f67f9e02cf6273172b856ded617a61fcafe
  • MD5 8ae724ab3e2563c045f22b247bb503ca
  • SHA1 b83ee3453ede32642ed99b27b726d7640e3b9f7e
  • SHA512 2b1da1732b583c3a66e0a7b35ce73a63cda90aed5beb9db965fddd75e3f1cc721bda0bb3ab06e38569a9d23dc2e1112d20a4c6ee465d42287dd06374c41df43e
  • SSDEEP 12288:R8xa/zmcDXmbrEtQNwRxifuSuGcaCpPUKKcLP/H2xKiWmY0qSh4Gs:R8xaak0QtQNa6uS9CpUKKcLnGKiW4qpP
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookhy08discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2