Extracted

• • Target

    INQ242190.exe

  • Size

    549KB

  • MD5

    15b1d07b7730263710445acc7d3fe916

  • SHA1

    aeeb575c62225475d3098bcb336bf2da83b4f625

  • SHA256

    5bc4574dc91259c37e24e9fafd52c4798d2ac0b04bdce4ea1959b1c4a1bb1be1

  • SHA512

    8578154a6aad6c557afdb7fdeacb9300da6855dce24be4eb11ecfb98d70f1de5b81ac39867c48388ca033e03c2b5f23bf50d00c7f4498f6e33db4b77294d51ff

  • SSDEEP

    12288:p8yM6xjUjr8M1BwIHtexCLuBQobO7B3YFgx2fhyGvJGI:lM6xjUjrwINATyNdxGVY

  Score

  10^/10

  formbookc24tdiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2