Extracted

• • Target

    LF20240228.exe

  • Size

    743KB

  • MD5

    83e3cea3b92603057eac3c8991f64cbe

  • SHA1

    eed62adc7c7d06a5ba530fcf763b9a167c5765b2

  • SHA256

    1091372b812b70532f2d29f18f41f1618a0d72ec9e03caa5bc02dda877ff04f9

  • SHA512

    8e0ebf0fcdf3f5f0b7d8d42a8c5a2f6a792ae5ba2a069fd14217a7329f2a7b91674eeb9bdf2b0d9fbdd12e047a5ef85bf6724f99b67375d7fcee73546be287f5

  • SSDEEP

    12288:uKghZfmcEraWlPrMxQKwu3zIEG52mh7CsLDEbZjfgS0v2:Rg/f6raMMxQKwujIlh7dDE1Er

  Score

  10^/10

  formbookhy29discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2