Extracted

• • Target
    NEW RFQ7926.exe
  • Size 884KB
  • SHA256 c2950027214694211b93f45aff96f7eeb0b46c5ce15235a9775b50597c565416
  • MD5 ff8c5a50694d78462d9500af8956f1a6
  • SHA1 77ac089b9b7ed330668ca0f328daac4d33095aa8
  • SHA512 a98c8500259547b42f97823ac434204cda7d8e7c6661713084f171d47d9370a9d3cc23dc8381abbfa229d6141a9b559840393671b5ea67ef6e8e5b034a7d529f
  • SSDEEP 12288:XW1Gie4yMZfBXAxZds4eSTFJ6G15mrEB6DpT5+xD3Sszs2A/MGAGj0PX8zn:XWcSjZfBQxZOqF0U4rE6DLgC+seGAx8
  • TLSH
    T11515121C32A5CA07E5B15BF15AB1F63017793E8EA821D60A9FD56DEF3935B004E28B13
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  ge11discoveryexecutionformbookratspywarestealertrojan

  • Family: Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2