Extracted

• • Target
    BOM-V29--20240618 Overdue.exe
  • Size 696KB
  • SHA256 cbc824c8cdf2c25b2b4e2f43163f34232ecbded388c7e0c0f01c52b4657e8f7d
  • MD5 88295402509cd6179f6366109ddfc576
  • SHA1 7623027c3bf6394176e98784b598d711698d5350
  • SHA512 9f438650d18c88f198d6e90bae25f8d32ab2dfee0155637c69272b6c434f1970fa542474e807444936833ee9bd9094706dbf3de55dc311198753503a81a12871
  • SSDEEP 12288:cGZKzvuLBKYvI8yuQoa5afqsEO6KcMQ6y+j45cBrx+qaxI58lRWPxHvMCDtHC4+e:JLOPu1LDEO6K9FDl+qkI5+WpHkCDt4a7
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookp25odiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2