Extracted

• • Target

    QUOTE 07022022.exe

  • Size

    805KB

  • MD5

    82e82e8e5dee51606502d3a124022be3

  • SHA1

    5817dd722396876e744cc011a52ecf9d95545474

  • SHA256

    c1b340618f246ec98f4f1c891b2fe2a1d8708c1710a567a0b0fb811add67b75b

  • SHA512

    30bd3d6235eafc357c34f5c62e1c9e6e3cfb5467d434006bf8c14d9a83aa2e698c00c8f1805bc8f2cf0bb55ebd41637642154b571d2a6c8e943f999469677577

  • SSDEEP

    12288:4uzMPvhqL9pYgcHzLxK0mB9Ee7ZtX97Cv8/YbtMQBMGJj6knVRpl2ussRI07dVwy:4uihoP0Lx8Ce7F73/YqQaPknzp9sWI

  Score

  10^/10

  formbookm25mdiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2