Extracted

• • Target

    OZsK1zm3hpiRCD2.exe

  • Size

    751KB

  • MD5

    2e5a55a46c75aa53efd566270938d168

  • SHA1

    ce2dbc6468deedaff70830ffa2e7af2c2f36f333

  • SHA256

    57e610ffae08a6189ecc331352a5115093c0c8b9372756b2211f2e164d052dc5

  • SHA512

    8eef317a65dacf9686df9b22b47b9bf6738ec607983740279079b9927f02b4a3413b166500f7c11e1944b62e241aaa0552d1e2b73755dbaecaaed178a49e72a1

  • SSDEEP

    12288:v39mEqOVzmIJnfTu6EKrVwTBbHsot5ZeVK7EWWlPYnlMWn:vIEqE6sTxBwBtve0WRnW

  Score

  10^/10

  formbookt18ndiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2