Extracted

• • Target

    QUOTATION.exe

  • Size

    660KB

  • MD5

    e34a83c5086e9cbe2047a34ca0cd3809

  • SHA1

    2c1ab68a80193670c27ded0af13b4eef244ee15d

  • SHA256

    e2a79d9566fe26bb36b8600c268f2eda5f66f17cd2241ed5bdcab62dc2622aa8

  • SHA512

    1ec0e58a191b9e8ffa26b89f90472e79eaaee29282f8c1fdea7e4af78dc57700c63b505a6b441e1271001f150c2061e5628aa1730b9c1808a9c270770fe008fa

  • SSDEEP

    12288:XbeXOyvWCP0a4j6I9IpcBTP2VTjI/jhA6aTsnYPrYIPxk:LeXRvzPI9OyTO4opjYGe

  Score

  10^/10

  formbookdn13discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2