Extracted

• • Target

    PO#801624.exe

  • Size

    770KB

  • MD5

    c1635c946995f26c2bc72d1447c1cc6d

  • SHA1

    55463dde7149dbef65f81050bfe7c6339b0017a7

  • SHA256

    fd7a998d2f4db27ec6b0ec32459571e124128cf57ed9b8236374dc68519c8fa8

  • SHA512

    978e8aeb6ead9e24a70d99c7abf997ecde00d9b7be4017c9b66ac2d27dd9e38c2935f579d86c40ad62f1ec8095fdcd4b5de98e07305f35834d4b36f79182da62

  • SSDEEP

    24576:d9x4mDEoD8Kz+/22LlfcLsXetxlaIGgVT:d9x4mooDLzE7TYxlaq

  Score

  10^/10

  formbookc24tdiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2