Extracted

• • Target

    rlxJk85y4E3Cu8R.exe

  • Size

    797KB

  • MD5

    4be5e463d0add883315a162191a36a4d

  • SHA1

    2a23189d3da383aa49c07ca7e05bb943813662a1

  • SHA256

    812d0912e299dbe0eff0078fcced87ffe5762b103a974dd19cdbb4c21294a193

  • SHA512

    415a570ea23d12ca8d5f1d597f8373ffc4e57d05145c2a0666519a8b53852c2bd62895a7569abb2aeb8b5109434afe056129aa48124d0b10e147eab5a0c07435

  • SSDEEP

    12288:DuEcsm04vbBoaGoE80Dir+hOsh79T3C8yG3ZAmwIDH2yZPZ6b1ID:1ct04+sE8wir+0s0wZ7D61ID

  Score

  10^/10

  formbooksx01discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2