Extracted

• • Target
    WRONG BANK DETAILS.exe
  • Size 576KB
  • SHA256 8762ea652c974bb0aa9bdf338ed57d46c251f72f5f1f4a5bf4d40c9961d8e2ee
  • MD5 3577b6781c96341d85c2d789663996f1
  • SHA1 6b92b743ddf5e0a38a38ecedbc71d5d66dd1a24c
  • SHA512 9ac422d0c3a23460bcb5299fde784624f0c271385dad05679ee375400b25837ec83a8ef3f579ff5c0283b4469051c6abf0f132ed59264bb20720231defe886f1
  • SSDEEP 12288:R/nqjqYBWEjmDVEEBFGpfAvAUcpghwG2n2HtgmmeEnHSUh:R/pUWEYBQp4vAUcGCFn2HteeER
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookt94gdiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2