Extracted

• • Target

    SalesSupply.exe

  • Size

    692KB

  • MD5

    252617c6e8ca9830c1e7c8e48f548618

  • SHA1

    4bfffd5cb4d4b5df96088bac6c2376d77847d8a3

  • SHA256

    f42de693aaae005ec4dcf3514621f8573b422f3a3ad1bb1af370acc7c5cba233

  • SHA512

    07377e448619f2e27add84831097f3e4104b8be35863d58d14e3a7d8fde8278087b8dae60fe3018e7b078ad2784ed6c0c150eafddce2194f5d1797f2f7796213

  • SSDEEP

    12288:ShFtODMcQervTsFsrjWzWV2P5DaDPp2VZ9J4Odx+tST:SJGaerT2zA2hDaDPp65dvT

  Score

  10^/10

  formbooka03ddiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2