Extracted

• • Target
    412f36cadb0568c43f0738c6a832f9096fa5692c8271b1e322b570152084dc31.exe
  • Size 1.1MB
  • SHA256 412f36cadb0568c43f0738c6a832f9096fa5692c8271b1e322b570152084dc31
  • MD5 e8b684a181e745c7e80acaa0dfa96193
  • SHA1 cf5c3059ac345cb5fd3d943e3a5a27642ad2da0f
  • SHA512 69f505d8bcc98a657b847ebc7a30e33c2f80394cc92dc7dca2fc2af7566678f4929324ffa73d5fc42a7bd8e17940ebcf108b6b75eca10cb3e196b104c8fdcc2c
  • SSDEEP 24576:ypwQaLmSnf3XrxwPr/Od/wLq7Mm9OCH8MIRi4Kq2:ypimentiWd7PX4R2
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookdk07executionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2