Extracted

• • Target
    rPedidodeempres.exe
  • Size 568KB
  • SHA256 0b6626a93de029cfa30a8b9e33aaa49f648bf75d36a8cba9fe199cfae9bb86c0
  • MD5 d7432d2c97123ec63bd42d5e115d73d0
  • SHA1 e05d50ca4f65840845913c99601523184209e044
  • SHA512 155f14435ddf7466921c7cbca03d249f59ce3ac65fc26b9a0f45de8ce90f5cba76d26c9d133e998e9a35f676728c39d634d28405af3555b20112a4389168968a
  • SSDEEP 12288:y8jOlHs/ecgjRViavvG0+DJszNCiz5RxD9g0lCOIFkga1mM/X4WEC7K:y8jus2cgjRQavvGfJswK5RxD9g0liSHz
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  gw28discoveryexecutionformbookratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2