Extracted

• • Target

    FEDEX TRN 771893954554.exe

  • Size

    2.2MB

  • MD5

    22b365e10dd635468212251994b194bf

  • SHA1

    069d6d2395ec518d0156b6d02519d3b8e896e5b5

  • SHA256

    7f9b8fcc527d02e66b49d76ff52297d69dbf237a8dd4342fdf3f49a2189c67d0

  • SHA512

    fbb27e9c38a6f351edd756b00227c42b98bf08c89c1c85e3b74462a381b61e4347972f373327f540b5744ef661ed0c1b3072b188616d5a5950478720bddefb1b

  • SSDEEP

    24576:iB26eZ4fTPkhZ2PAG0pMn6+YZ8IOxSD68Q81Zr6kNefAd/YK2HzQX9Kub+YSgrBK:Zhhj+EbjDE81R6iY7O

  Score

  10^/10

  formbookoa09discoveryevasionpersistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Modifies visibility of file extensions in Explorer

    evasion

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • YARA rule for Mozi IoT Botnet

    Mozi IoT Botnet detection.

  behavioral1