Extracted

• • Target
    z83obqahfw.exe
  • Size 636KB
  • SHA256 ec66f68731b1c186ac1c87c2520106f85e2a25951303014b9163f51c476846be
  • MD5 946ddca6df1a4ad1bab2b6166dbd516d
  • SHA1 7362693e6ac7990c7456a47c09a1e7463d855e26
  • SHA512 b8ebaa3b5aca238c4e7a4e2486b3d017d044fab1a3eb9e65c3e032751386909117b74a9e48bd5f7969c1fc39c5301d623617ca8d128a8e702163878dc738a43d
  • SSDEEP 12288:DzaDPw1Qk89Tmyx6Dz1Xy6ICOHdhWMTqJFl/UYp1pinxVy/56:DWLw9gTFg3MYsdhM1cYp1piw56
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookdn13discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2