Extracted

• • Target

    eUJXFbdYlsElzgS.exe

  • Size

    580KB

  • MD5

    082d39cfd34b71fcbcd6fde04630a9da

  • SHA1

    0158f6fc8b93a002d854eeea2a67fc1e6cae6781

  • SHA256

    4b0172ec49e672667d9b9ce4ff5ea0365ce29118728adeda23e5c21e7e170ba6

  • SHA512

    10b9f414c84e95acd51225e600cf8b36627832986cf01cb5864bf134755546cae5db24f86b60a9364214d140f7761670b7ee67819d7b0519e7de3f9173461fbe

  • SSDEEP

    12288:8zJGCGrsE1JwH6lWGs6jwt4IRBFGJgoUo1ID7BPQ:8zMCYsE12HSWGWt42Gmm16B

  Score

  10^/10

  formbookt18ndiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2