Extracted

• • Target
    d6c03cce5773652c4cb266084f901b331550d57a656240d20c288484657cd701.exe
  • Size 612KB
  • SHA256 d6c03cce5773652c4cb266084f901b331550d57a656240d20c288484657cd701
  • MD5 8c2635e6c2804ace5c6fa487f5e23a87
  • SHA1 334e05486efda6725b100a9365d5017aefb90e22
  • SHA512 25b40d504047bd3001303c59c72756d7174dc3b0e9731045e2a4cd57907333f4203ab8f2de3f4b99fb96c6ef5217dae764bfcca980583f7375a39714b78dffe6
  • SSDEEP 12288:xdJS4VayvR9/7MY12/bsozqhJf6fa8OGawEekrNYoAjjQkR:hScnpFxE/bsB3Si8OyTp3
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookhd05executionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2