Extracted

• • Target

    HBL NO. A809001229 Overdue Invoice.exe

  • Size

    616KB

  • MD5

    2e01a496376347f3110b695c161886a5

  • SHA1

    c8beff4d44122a0d47c47ed30622b715afd7b8fc

  • SHA256

    678004924997022281c09d32fb5aea4e95154e26f42891764628c74e2cd9a117

  • SHA512

    8ba39e08bbb323909b2ea657eecfb25211d7bb9160a6e32055e6845545b7cc67e6bc70b675129f819eb015fc90843c6a8b06f7d8c0d08cb444d956e5ef5dbaa0

  • SSDEEP

    12288:IIMusyUDVFiHnINGKp+Hq7NHok4+IOMzpFrGoVXoW0DX:CfFiHINGKp+op/hWrGyXovX

  Score

  10^/10

  formbookp25odiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2