Extracted

• • Target

    FinalApprovedPO.scr

  • Size

    736KB

  • MD5

    92f57354478728b4b1982d2acfe79393

  • SHA1

    5d8dde6e098981b329149bd0b87eb42baab32b32

  • SHA256

    59985a17d6de339280dfdbbd0ab6399e8f9f736de109d41feea5b5f4f46f81f0

  • SHA512

    6c7d00322951dd459f77cd27ae449c46d65b9e88b85b0df2b3c745a4bbe7ef0562a17e620dda84d4366e71936131a5214c7dd81eb1714dff86cb654e27c2d28b

  • SSDEEP

    12288:E5/6/hRSUun6oxsGv7dgTnvtHOUL2zoVbpig9GrghiAExkR:c6On627dgTn1BCzoVFig9GrUiAEs

  Score

  10^/10

  formbookg43mdiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2