Extracted

• • Target
    hbwebdownload - MT 103.exe
  • Size 661KB
  • SHA256 3e26ebdfbd46dadcbf46c199970362689fa6ca0e0abb65ec703ca21d08b7269f
  • MD5 42d6700f5272596c025308992d4fea37
  • SHA1 09db89002aa3793dfbf04ace1f62eeef11086415
  • SHA512 e8175443f45089dc9977ff570b3214921f2a49fd9e097fca6a87494021a7a24eaff75ff497367d7ca3c675cffb321e6c9f98b3a62cbac820fca4ec73b1792e6d
  • SSDEEP 12288:h54hoC7N+VZp1YFtATOWVVT+dcL/BeUO3kR:27yZAUdVT+dcdOi
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookc24tdiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2