Extracted

• • Target

    New PO (#1437) New PO (#1437) New PO (#1437).exe

  • Size

    586KB

  • MD5

    dab8524799291672da26cee346c4dffc

  • SHA1

    c6a796dd80af49571da33151594ff87268587473

  • SHA256

    a99e96240277999d6ac2c51b1071298e9488a4e08a24f3ac934c8c1d5f68fa0e

  • SHA512

    a70eb0635b1a71baf8efa8495d073b2a37e692d3fa87ab12c977d7f45ba90b0f042927b1faa99e19ad8e15b92ce76cdcc9fbf5293db3a12fc2d55513ce06dd8c

  • SSDEEP

    12288:To0nsDOVMMVJBTYeA8paM0C8da9lrVxSZEPnag8n8xcNWe1WbPkdG/m1sCSs2m:Pnp6JKH0F89fCcaDnPRhsCz2

  Score

  10^/10

  formbookmd49discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2