Extracted

• • Target

    f49a18388f070afc8f7a17f6053666ba.exe

  • Size

    718KB

  • MD5

    f49a18388f070afc8f7a17f6053666ba

  • SHA1

    d1062e2c38badf9aac1a2c2d0bf4ea7f3e07341b

  • SHA256

    3b746894d0a71f6162d96d2af36bea8d794d7e23af44c5536fcf97d416510a6e

  • SHA512

    6557e22c3e5542262cb8d9ae6c1a79a17f8ce2b9666dfab3ea2df5acd8c23bda607358569b75454cb49a3d36448c08a1a671923f27c13b2473d5925842a7cd34

  • SSDEEP

    12288:Me0ReLAfP7wD6ZtqzvBzmAqdse00yzr+zdW4WgxUHPp8RGHwAOovhbuigPc20mk1:Me+537wDAtqFmAq500yuZWfK8QrQh

  Score

  10^/10

  formbookht3dexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2