Extracted

• • Target

    PP-200446-FDA.exe

  • Size

    848KB

  • MD5

    f54a313e117d804ec248e65fd4f49e6b

  • SHA1

    f3c54d68796730257bc7b9c29b28483ad301a71e

  • SHA256

    370d1eff1cc2c669efd391ac0a1bd6134cdf7dd250bf667c78cfc7447f7ed168

  • SHA512

    8050a6efdcc08d8bb272927d82d5fb23577be176052e54492ac735c02282985af927501c5fca10dcb4af9fb17fd3799f31d8493959edc2f4207e37d33eb4997a

  • SSDEEP

    12288:PZdsIR4R52J+XtvQKHqYgL3WHLEmv7YK+uVjt6Px1bDsoQtuE6ZS7pLFEE2PS6go:PZdsIeeZKHoGHLEmvwywPxctJhFacI7

  Score

  10^/10

  formbookpy25discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2