Extracted

• • Target

    SOA.exe

  • Size

    584KB

  • MD5

    a23f608230a404028b541bcfce9a6704

  • SHA1

    ba91b94100ec0b7350e8cbfe42879fa8032eca7b

  • SHA256

    5789d779f7aff954b10c95ab92c85c787c25f4b348f43db969b70c5329e74b93

  • SHA512

    866fbc614293427b006bad91d69d45e6c65e6693713e55ecec7fd35253b56e709a129fec97ab71750f2ffaa64b98c28984c2ebaa5b659c5d398a39d91f1b1ff3

  • SSDEEP

    12288:08XO0aNADvB4s44IwaA7jt2wFHrItx6AD0OaaMLi27IKhgIm3YMnkR:0LyBDqYtnFHcl4OvMwdNYMy

  Score

  10^/10

  formbookc24tdiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2