Extracted

• • Target

    z18AMOSTRAS.exe

  • Size

    614KB

  • MD5

    a108109409eab70287eff47e6365ff7c

  • SHA1

    83aaeb34e9410deef1ccaf6762e580821fd6c98f

  • SHA256

    4ed108b6fefaf7195648ba17ba194f04e8db13cec7e1adeb56ecaafa970f8d21

  • SHA512

    2278bd435b8a27f916a25c3bc2c3d496eb497a73aa75e469a9d0f0af01aa9d0c786d3d9eb7832a275fb976e23214ed0cd8e0e5517b103d9c71a6b46a2dfbe43b

  • SSDEEP

    12288:QMfzu2hn2t4ORZ4+w9BF7cdG8ALKxppsCTf9RIQ/RYTLx/O4eq5V:Qsj8WOr8PFj8AokCTfYQ/RYTLx1V

  Score

  10^/10

  formbookdn13discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2