Extracted

• • Target

    Quotation.exe

  • Size

    773KB

  • MD5

    439dad5646f8f78adada2e1d5740d0eb

  • SHA1

    85ab73db3b73f38a97a44e0fddc829f2d5977c8a

  • SHA256

    69dec355a88f71f9880052143f091580cecd4c6f301c1c6fefe931d44bf8c77d

  • SHA512

    d867e2f561fe99d8fdee5abea882ff27b560ca60e22736c3e0862bf409d70d233cc204b37b71133f96c3f7827f642ae9335b07891ae419815e29f45fdbbb18c3

  • SSDEEP

    24576:VmMt9lRuEDUgbwUCGnksyrlKNstj4Pif703:0Mt9lRu19Alyx4qj1g

  Score

  10^/10

  formbookdn13discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2