Extracted

• • Target

    Quotation.exe

  • Size

    773KB

  • MD5

    4c38d69491c3bc94e2348af4447917be

  • SHA1

    b8c6225c52f8c81031e735d5b87daf26b0348e63

  • SHA256

    4b50c23f9c20e569699daba5b9f13a3f5e7e3b9977e38b105aff0c8b18fcba70

  • SHA512

    c1a28aa883c0f6315667c35f539379779fd7e9dfa6956272b9a64dc1475622a7e24246b172a2c3bb03dde73b4d6986cea4b07100505f6beb9d027dc086c29ff3

  • SSDEEP

    24576:4rMoei7fgfET/cic6x42c7s8TwMKGwhFjoBK:4ocIET/ttcRwMejP

  Score

  10^/10

  discoveryexecutionformbookdn13ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2