Extracted

• • Target

    STATEMENT CMA CGM Bill_1004053123.scr

  • Size

    787KB

  • MD5

    2ceb6b17f722d70f80c4fe5039a77d7c

  • SHA1

    ecb4c92589f784ad48ae142524ea83a90c84f49e

  • SHA256

    4c29444c69cd3131420c341fa7af2db856fdd6d358bca6d57325fc9903601b4b

  • SHA512

    1451bd372802a43bbe82357dfb5642ce63c2b2d7426c0723427fd2401d9d16f03d948889a806d36a779029c41e7ba4aa99f729dbff39251d28c3cddad76d3a49

  • SSDEEP

    12288:cN59USLSFOfwgMZYRXczKGxJn3bBo511cOUdleodsk1ODCrYjrW3l1PN5MW:cxLSowXaXcz5nL5OUd0odTOuY23TP

  Score

  10^/10

  formbookcu29discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2