Extracted

• • Target

    09payment swift copy.exe

  • Size

    678KB

  • MD5

    9b6ddf7049adfbefacd1dbdfe4350061

  • SHA1

    e9451cd4cae7a1d50ae0cdc17156dc685b5158f7

  • SHA256

    422bb7209a36ebb05303bbf0e6de6e1fcaef855b360f658eeee67ff9dd49d5bf

  • SHA512

    fcf96b148e9a5369a264f138621a67eb8d3c79b3a39587e5b225aad94dd103fa67b9020b7559d41212019b4c168e9dfd7b7633c6e82a8248261cb5d1cccfd5a8

  • SSDEEP

    12288:G59aYwdc1sW7/sVfmPc/VZHkcAG8Vf+0Zhaewy8UQxTJDC38Sy:tYP1L70oc9ZEcA1L6I8UUr

  Score

  10^/10

  formbooka02ddiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2