Extracted

• • Target

    payment.exe

  • Size

    707KB

  • MD5

    23abe3c84b5db078cf92723357670b30

  • SHA1

    ed9dd2816ee1f01252f0221e1bf717a531440475

  • SHA256

    7a4b80b6d3ea4ca73224197f7d85d763dd953826978cdc30c6e75fb298cfb5ab

  • SHA512

    cab42f389efe9faee486d58d31684d79fd7a3f42c0cee5125f4e6b0dd4d72aa94f97cca167eeb42612363cad9679f21a2986cb97a7673d2266cdf05b7b4c3eb6

  • SSDEEP

    12288:TF0dkI8Xp4gnV2v8gWfRhkMpCof0xrQ53Ms8a+U/gSaE55BO3Uug1o474q7:TudexQ8PfLJRf0FQ53S1NSHjzuU+

  Score

  10^/10

  formbooka01ddiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2