Extracted

• • Target

    9fb018d34d80db3b22e721e2768f6bb5.exe

  • Size

    615KB

  • MD5

    9fb018d34d80db3b22e721e2768f6bb5

  • SHA1

    bba13f32dc03ba024b55a76e92137dec699640cc

  • SHA256

    8ef8e3afba42a19e43c2cb6f591ad6ef601791db37b5626f6102e6c4d39667b7

  • SHA512

    7f8a28f648b48bbbabdb7c7d78329fe821a11a54b40ed921be460c9875ba02307535cb0847dcf055497978e360f754083b67bc18877c6d6f2cb6b34aa1b3c2a2

  • SSDEEP

    12288:u7gn06G1PFB897MDygmTpOAfTCts1tsLFZT/maWYw6EnKnqcgaogPkUhlQlbnm3q:u7u074JMDygmTpO7UyLvNvXJ9PkUhlOQ

  Score

  10^/10

  formbookdn03executionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2