Extracted

• • Target

    სასწრაფო შესყიდვის ორდერი.exe

  • Size

    656KB

  • MD5

    2a40336c0118ebd499979f2ade0d182b

  • SHA1

    5e17d2b9740c55aa0d5a7d59b058d9ec624fa8a6

  • SHA256

    8ebfadee37467f95eab5405dbd6660ff7ff38f82fe61893ac9b03884a1099110

  • SHA512

    11d986a8d045e3aa688c23294eb2aa441856d8acb2c8118e5013869343919bbfca3382eded88ee784051a0ab8c5348ff35ad24b39ad94d6140e8c0fb4df02fa4

  • SSDEEP

    12288:bbMKRjIFdlfh+7nLNzA52h7O56CSQfZwrxTFoHNA2ZPbx8:bbMy8FdNh2npz7h7e6CS6TNNbx

  Score

  10^/10

  formbookde08discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2