Extracted

• • Target

    Payment Advice Note from 01.10.2024.exe

  • Size

    677KB

  • MD5

    86926b8ab8f00f27eb69f2793db47f68

  • SHA1

    fb0e93fd743510cee1045712d1dc8dd887a3b9ca

  • SHA256

    596681238e749d9109fd00bbc95f364f4cfc5977cf1d2253bd8ee268d6dbbf2f

  • SHA512

    b0276dd9ac758a4e0f02d311c6605aaa315d8afc6a29d90e8a4685ebec515febbc107ac7c129f7ed29e63d60103d354f4495db2573347850235ac5aff515091e

  • SSDEEP

    12288:RLbMeV3JxmLAaK/d32fOOce2F7e6PMLeLdAh3qMu4UXL6L:R5bxmLAaMr9e6kSyhat4UXm

  Score

  10^/10

  formbookcu29discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2