Extracted

• • Target

    E-dekont.exe

  • Size

    740KB

  • MD5

    3eee9378f53abfa4a0f14bc2b21444f7

  • SHA1

    1d9600e5889c31bd94eef88437d9b6adfcdef930

  • SHA256

    4624ef5fa24a2459eb8c1504e9bdee4e61e762680ee5bc5f2f52c77f197648fe

  • SHA512

    f9a1a943c8f9bde431302a81b4986cfa376ced72fd5510d7f330d653cc00e5523c993a82e774a01db956da7ee311142b4aadd142970ba9bddb10b2af4b934696

  • SSDEEP

    12288:IgWVFxEViHEmbGqdI5UrPcD/YAp99IwxGoq2uYPnV7tqnZxaFYRwySnUKj:lWVFxEAkmNdImLKAA50oIYPnV7mTKySD

  Score

  10^/10

  formbookm17odiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2