Extracted

• • Target

    PO-13228.exe

  • Size

    576KB

  • MD5

    7038d7c37a57257518528cf5fc50dc1a

  • SHA1

    0b352e9757af7c23439ec521171b2e05813bfe16

  • SHA256

    0e95933b378d0fbe6e132bab051ab9a3ab4fa3332828e72a0133749c1150b79f

  • SHA512

    ebdd545d9b8260b827376b6b70b47ffdc19eb32ee72acc16339c1af8bf6671e843019519ab03fa6058bc4c449bbfb7f8f129a13ef0f01ddbbc0fe9c718ad9c3c

  • SSDEEP

    12288:0/JWqjqYBkH47mWq6fJqYQqxPcTO2DieaVTNeBz6Zwq:0YpUkg9qNqhcT8eINF

  Score

  10^/10

  formbookm10idiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2