Extracted

• • Target
    tnbws7pyQvMUSjF.exe
  • Size 731KB
  • SHA256 03b5cfab3f0ffdf96e415006004be9a0c05e6365e1d5834984cfd5cea9df85fe
  • MD5 17a1259bd9c1cb80ac8d105d513bed7f
  • SHA1 cae2ad2f6a8055ad2145e25324d29033fe1133ae
  • SHA512 f3edf3d6e0c10fd71e411c78fc7af1db10c0c4d56cc796dac113eae2afe96ff30eceb4d0c275a48bded4aeeb353e1a6d22f19f754baf1fd218b8fdaa63ff12b0
  • SSDEEP 12288:XTrw1bZZn9LJ/x0NHhVdAU/ocoHqXNAN5sNUEj+CQBuxXF29cGNzw1ZW6bEm7N52:DrwLZnR30xhDLocIqXN8u+CQ0FJGVuZN
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookt18ndiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2