Extracted

• • Target

    purchase order.exe

  • Size

    547KB

  • MD5

    5296af4ed8e6f9d06274547012b5ba62

  • SHA1

    2da877c31b6213e05fe65219bcf8a422cbb5b68b

  • SHA256

    fc5677c59829c91effde4a5b050dd517d089cee3a6bf9eb752695f3402e2dc28

  • SHA512

    77d9d10b1cda513fcdb04bac41ff7511a301c450b6f2f23a2bd86b1f709a58545ec53baa961579b483999d1579c5d47942e889f2a66fe84e327c25947f9078e6

  • SSDEEP

    12288:f0wru3+OWz4QX9i1uNU1ubuMFZ0K6SYwg+5dVZ54ohPuyrHQj:swyU9iQNhbue6PHOdVZ54oa

  Score

  10^/10

  formbookt94gdiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2