Extracted

• • Target

    RFQGUE245801.exe

  • Size

    548KB

  • MD5

    50b2874b18ed801760721ddeceaa2e2f

  • SHA1

    28be937d4825809f593da427dd258b2aed86e05a

  • SHA256

    b71b353da449108a5ed6aac6e44133552651be0099dbba14884af1406874eaa0

  • SHA512

    eddee0d37ff0847c01e910d8445cdf91551530f4eab74a6ada32995a6d577ab2239986580887314578e54bb99fc7a4d84ff3d5de74848506951e8eb5c5bbfb24

  • SSDEEP

    12288:Kwbv8EXjsnoqXcT6gEkF6lLWBmccwip9X5C/ow:hbvfgoqs/Eo6/ccFk/

  Score

  10^/10

  formbookc24tdiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2