Extracted

• • Target
    RFQ 2403.exe
  • Size 589KB
  • SHA256 bf7619fa136dc46e5612bdd8635e13618db486f01bb18716713a25b096331d30
  • MD5 23f2b134d5b7bce69858d4fe46e70aa2
  • SHA1 90f75b12b19e4dddab93fedb2da88bfacaf2344e
  • SHA512 01ce8f2a22f18bda803c65163a9e034ca31c329c5a9c62e7f253fe69afe842e53414b1fc4753994fa4272bd270b58786537d3f16037711e9219dd9da2997e091
  • SSDEEP 12288:uQ8bQb9PnYoAMnmgQqdARAkgnChnt8w/zpTEKPUHL9ZBtrML9dS0DFy:uTIR0MagsgnCht8w/dTEKPU38S0Dc
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookg29odiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2