Extracted

• • Target

    QUOTATION.exe

  • Size

    597KB

  • MD5

    5ef5a1d3d29621fddc9bdc633da0a90d

  • SHA1

    83addd1df3377f9e3e7ba76912c5ac1a573a522a

  • SHA256

    dea7a268c93cf1c1298d1b9afeff6e7a6bc1a4798f2f237b3e1094fde2fd3f9c

  • SHA512

    f6c61a0f6eef46300e4de98336afc81d699ce0a4ac8c367eba661efc2acd77c4e45495f59474c20b177269b27a7acce085c11794fcb881f944fae6af85aa9426

  • SSDEEP

    12288:/GxOSlVNuFIpZBMWcus9XstaCb2Qw8bQbK:hSDqIpbMWcV9XoNSQzIK

  Score

  10^/10

  formbookt94gdiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2