Extracted

• • Target

    _BUSAN_HOCHIMINH_FEB.25.exe

  • Size

    738KB

  • MD5

    08b4042d2a89ebcff8537ba458295e48

  • SHA1

    91e3fd4718786c523620c31465232113580ea477

  • SHA256

    388292015e4c2d075b935a8299d99335d957e3ad5134a33f28c4dc7f5e3687c5

  • SHA512

    5be0e94d68f8d0599c9323bb4c03635a0e000ff541b9924f6b83eba8adeda55c9528c818093f690249f51cd1976389c77d841e7f373fb1b5d362ba57ea36a222

  • SSDEEP

    12288:dwRl4Zby0chFFQWNd9M/VqnM2GQkTtZrD1fNABd0ioEXZm33h:elIbHchFv6/6TGQk7Ly0aJs

  Score

  10^/10

  formbooka04sdiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2