Extracted

• • Target

    TEKLIF2002509.exe

  • Size

    596KB

  • MD5

    7a3bfa8d0ab2a9b1258925a73a037393

  • SHA1

    5785960ead180d8709d2b4e182ada67cf751a85c

  • SHA256

    8924d6255fe634004cc46de0a9ee6b4d7c44c1612947d747ebea2a6c06d2a37e

  • SHA512

    aaf55fa5de8f5c8755383694256a369ecaf31337f6a768ffff22e76f16a5413bce56dafe7efb2145c43591d9f214770de0d0596b9094ce65a683157bd0baecd3

  • SSDEEP

    12288:5sy8bQbFshgdcUTejQDo7ryDKdQRFlPHlhBhiJ+UXC/:KIeQr0HyDSQPFc+US/

  Score

  10^/10

  formbookbc01discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2