Extracted

• • Target
    eaffc7cc6da06f5894642bb88fff4a0186cf61100558af3cb552145f86d8e041.exe
  • Size 841KB
  • SHA256 eaffc7cc6da06f5894642bb88fff4a0186cf61100558af3cb552145f86d8e041
  • MD5 7bb0f568ce14d2350c704aea2c4bc9de
  • SHA1 3c6cc8de9a66613ce41f37cf1fd22990e80ce725
  • SHA512 f9b5df159bda1aada29fa079b9b1cbbf054828da34fe46f3bbab140aaebe5c135b1de25acb53e3cf59b72af80cb6199464e0a0e32f5a687e0fb7be9b778c057d
  • SSDEEP 12288:xlGi6JNf+wrwcmujqGaCWcpHrdTIonHhX5AsYzYlNTpGGFNtLPHU3GizlZjf9/8y:ShJtCuqGzWcnIuhp9ycGOBmA6
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookmd02executionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2