Extracted

• • Target

    payment SWIFT pdf.exe

  • Size

    735KB

  • MD5

    ed9369e24644b25d49b00072be1543f5

  • SHA1

    0c7eb11a4365a8d2c488b512f69bdb682d95cc9a

  • SHA256

    a726c5a24472b6e81e1dce922e3d462a1abda9da5bdb28c0f3893850560b1fbd

  • SHA512

    c9702ade8907c87b14bdb1f5d84cd0952a3a6f1fcccf1966773f56d5b0c28044705eb9fbcc0cb028a850c63ff0c19e5f151696b92960bce012b1e5447edd22a8

  • SSDEEP

    12288:Whn8nFllff8PcCPda11zL+GC9euIZsTilbNHwJm8LoNR8Vr8B6slRIp7:Wh8hsVPkXaGmJIOkYXLoNR2lsRG7

  Score

  10^/10

  formbooko10cdiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2