Extracted

• • Target

    RFQ - 401.exe

  • Size

    697KB

  • MD5

    4be29153bc863fa6d2914aab9759e6aa

  • SHA1

    eb30dab7d18b7bbf2673573cc96da82f6374d85b

  • SHA256

    ffaa78a8a97885716e7dbe2a4a7ed9e1593ea5690f02f79f5d63c9b4964559da

  • SHA512

    f3b861ecec9500c4ef20a4750c78b7505d42be16a9bfc3473fd8270720409a7a331af4d423f7bffc3065873a654a23370ebc229ecbfad591dae5dbf2239a9e29

  • SSDEEP

    12288:P1A+f0e7eDuu9f8ZYDrQ1I6030Ro1JPCnW3tQsBRwdFKPQhilBr4E1Pm6/cOkR:Prx4rb30RovKW3rReFSQIv1Q6/u

  Score

  10^/10

  formbookc24tdiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2