Extracted

• • Target

    invoice paymentPayNGATERRAX24176.exe

  • Size

    801KB

  • MD5

    dd46446038384fd77e9b50707d3ed26e

  • SHA1

    6b888ea643545bb6cc406c4f460d0d71c0753b32

  • SHA256

    36c3f143edb273d0d6cd6738e0357ddc19b86857de46871ba96bcb1a8256b1ac

  • SHA512

    2651b26968f5d92d8e3bf484feefe249b3d606e4cafa1769e355305ba88587cb90b8946254c42c7299cb562011a140710d39879b88b26da7c653c17bcd813e24

  • SSDEEP

    12288:nzSggsixmj5PLgm+++lMaVqskZO2kvvfRZzQPBXZGdygv4kOz3kfgq:nzm4kNNVqsaVkvH0PBXSygBOgg

  Score

  10^/10

  formbookb02adiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2