Extracted

• • Target

    z83obqahfw.exe

  • Size

    636KB

  • MD5

    946ddca6df1a4ad1bab2b6166dbd516d

  • SHA1

    7362693e6ac7990c7456a47c09a1e7463d855e26

  • SHA256

    ec66f68731b1c186ac1c87c2520106f85e2a25951303014b9163f51c476846be

  • SHA512

    b8ebaa3b5aca238c4e7a4e2486b3d017d044fab1a3eb9e65c3e032751386909117b74a9e48bd5f7969c1fc39c5301d623617ca8d128a8e702163878dc738a43d

  • SSDEEP

    12288:DzaDPw1Qk89Tmyx6Dz1Xy6ICOHdhWMTqJFl/UYp1pinxVy/56:DWLw9gTFg3MYsdhM1cYp1piw56

  Score

  10^/10

  formbookdn13discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2