Extracted

• • Target
    eec2040b640e5b1806119e1a428d54c4dab8fe87e2afe89570d158968122e4bb.exe
  • Size 573KB
  • SHA256 eec2040b640e5b1806119e1a428d54c4dab8fe87e2afe89570d158968122e4bb
  • MD5 90d93d073d92e1cd47f4d792f430bbbc
  • SHA1 3e4fe2f29722803551c31fe38aa04d97ec9150e7
  • SHA512 bd1daa7f963319f40e59c27870737f43e61e087c20cc0c3605a23910eb3a3a1aa27384f2c041d2a12bb1aed35adaabad6f7b797fbdd61acd5dde181046441481
  • SSDEEP 12288:rccadOGEW1ivxTRRSXyXQjDYq7C+5bLTTrBGZKGYC1DrJh6xjfHBB778Q6:IWGEW16TRRSKcAGbzrB4SC1DrJ0ZJB
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookfs83executionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2