Extracted

• • Target

    DL+Payment Release Details #Transaction Notice_Reconfirmation Process MTCRTTM.exe

  • Size

    606KB

  • MD5

    bd8229dde5d5dfd5bded095911b835ca

  • SHA1

    c1fdb6b6829afe4f2bb9ddac12cb384bb2dff286

  • SHA256

    93e9e99eb9d74a0cfa3cec7fea4a663b9ad5e8fe4e6ba38bf597a902ce592e1e

  • SHA512

    9d945c7baa4fc8a83323e72e324d166d18af7c9d1914906ba49ad27813cc4360d7f979c2c6b594199ffef105adbc4dc1708eee34c51ccba9877f898c87db9f0c

  • SSDEEP

    12288:Xq2PIZimzX1v9jA6FAOlyQMjcK6g+xHBMD1n+RuGJ4gge707kyLL1XXMQ:YT1v5hFllS4K6hxhMDSuRgghoyLJnM

  Score

  10^/10

  formbookt36tdiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2