Extracted

• • Target
    0445cc730c308b40378c9133d394004d55dfdcb03db7d26485736471af6ba41e.exe
  • Size 634KB
  • SHA256 0445cc730c308b40378c9133d394004d55dfdcb03db7d26485736471af6ba41e
  • MD5 70625bcdbd35c6873bfef64197312647
  • SHA1 64864eed1451eae8d076458fb6bc005137d1e7c4
  • SHA512 f2f709d3586c95daa1cf50715974fb0f55252142edcba96ee069b2e9ad10feb7ee83d56a68a0e7c0cc4792aacd944b4fe10de5b8459b23d80ce4f6ea2172725f
  • SSDEEP 12288:biETpbMlZRJIC/6GEmg3NQOqRK5sK3LIsbqZBma+LTpkh8WINLKtlcPK5S4T:HbmJIC/3DRTK3wmpmtQK5p
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookjn17executionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2