Extracted

• • Target

    RFQ-1024.exe

  • Size

    588KB

  • MD5

    3429170427053d7d39dc81b889d0097e

  • SHA1

    8631c8767beda82b2b14f2de215d745e512f3ea2

  • SHA256

    6dc1bba66cba9a4ee7a5156375e1935bd30c6b1022bea4082fb3714ce5c73e07

  • SHA512

    8c73ee16f331104895c338476146053b488a7695bcefbf9dea44385ba671ed31be065a03c30ae79a8118e02668f6a0fcaae5bf06d476c92156f0c4c6a4af2d6b

  • SSDEEP

    12288:pBtLYydPGLVH+xV4QL/ywRMufCXgnWusDYdhjB5gjYsSOBddtTJzkR:pBRFtGJ+xVbLvRM3XOWusDeNOjYs0

  Score

  10^/10

  formbookc24tdiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2