Extracted

• • Target

    SOA AUG 2024 - CMA CGM.exe

  • Size

    730KB

  • MD5

    47f67ecfb3eb722a3d7aefb8b5ac8b54

  • SHA1

    78da020402a8413cdf7d663a196c9ce46577bdbb

  • SHA256

    a327355ae6e99929d1303a762ea8a936d8e4884f45d683de08dba6882c1c016d

  • SHA512

    6b82898b826ee2fc7b8f1e39c4302cb69fef655bb6cc7389cb8397c8dcca28cbe3a81ec84d96fb1e13692aa833894b1b2ef7c56628685d42853808495a695ca3

  • SSDEEP

    12288:CQq8Tj0Kd+D1fDwAmlhwJogsFRot09s4KlV7N5r:h5f0/8gsFRouu/7NZ

  Score

  10^/10

  formbookcu29discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2