Extracted

• • Target

    paymentinfo.exe

  • Size

    675KB

  • MD5

    d3a2936e355fc5b62c309d80aa65e9b4

  • SHA1

    d7bafe72a3a8a9e06901155cdbf020d98f2535d7

  • SHA256

    19c20b84bd28cc534ea649747488dff45cb53539aaedc936ee2854f93cd6e368

  • SHA512

    01946f702c5af9696444a4c5d1db50390a53b2c0d849acb15c6079db32c3d7834492b357554d0daaab233c7e5024e452ecf6262bd23015558c0fc55abd81f116

  • SSDEEP

    12288:BXcTTpuOZhzNA50jBIiIe/S+wi+2n7nw17jIBd5a:BcEsdmGI7eK+5+2nmjI4

  Score

  10^/10

  formbooka01ddiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2