Extracted

• • Target
    rlxJk85y4E3Cu8R.exe
  • Size 797KB
  • SHA256 812d0912e299dbe0eff0078fcced87ffe5762b103a974dd19cdbb4c21294a193
  • MD5 4be5e463d0add883315a162191a36a4d
  • SHA1 2a23189d3da383aa49c07ca7e05bb943813662a1
  • SHA512 415a570ea23d12ca8d5f1d597f8373ffc4e57d05145c2a0666519a8b53852c2bd62895a7569abb2aeb8b5109434afe056129aa48124d0b10e147eab5a0c07435
  • SSDEEP 12288:DuEcsm04vbBoaGoE80Dir+hOsh79T3C8yG3ZAmwIDH2yZPZ6b1ID:1ct04+sE8wir+0s0wZ7D61ID
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbooksx01discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2