Extracted

• • Target

    HUAWEINewPO16426900.exe

  • Size

    580KB

  • MD5

    e0e6e7d9c723993d7172fc5cf35ed241

  • SHA1

    77b6944a9c19fb00172d436f4146bfa255013306

  • SHA256

    a2780a43ac1e90a6945c78cbcbd929863ab89c72ff1f86380f48303d051bc7d4

  • SHA512

    c8e85c71dfd68a31200a0ce760c104e868c35863027789c7523126c2c1335a1e6da6279459be4652cdb0927aa2c21cff160688b9bee44bd483684fd01406dc55

  • SSDEEP

    12288:HVf0ws2B6rJq5b/BnXF0kfT4RwLMbX1UXLMcNymOJ:HV3sE6qV10y4X5UAYOJ

  Score

  10^/10

  formbookcu29discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2