Extracted

• • Target

    Project 88399287990.exe

  • Size

    622KB

  • MD5

    3837485b707ee00ae594d8b339c56ece

  • SHA1

    df8dab1ca8581cdf2c8de899d0d4a8df8ca8d24c

  • SHA256

    71ef3a1c1b5deecad87d419dff14667503ffbfb7f5a16f5b53eda57ae33bde7b

  • SHA512

    6a243b10b4e556d4cf6c95f5f7d534f0ec8bd32f6cb5c153abfbdf2dcaa04c6adcb122a42cccb882cee90c98b6d50fc04bb9355f0de7a82a27e615ae10c39ba6

  • SSDEEP

    6144:UJ4uZ9l5FllawMqFj/02XzSlGDQNo/vSx2oJrZKhCuKEB96MFZN+4RSOKQm0umL:UJ4up5UwMqFjjU3QMVtuKEn6qq4I

  Score

  10^/10

  formbookksbdiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2