Extracted

• • Target

    1541552b46b3b5a0d35698ce1d6bde3da40971bfda8d65897b2d6f343d815e3c

  • Size

    831KB

  • MD5

    5ca90548bfafebd308ac134e049c334c

  • SHA1

    bf538269ba7f53b4bb1ceac79c7a7f296b7e2715

  • SHA256

    1541552b46b3b5a0d35698ce1d6bde3da40971bfda8d65897b2d6f343d815e3c

  • SHA512

    eb9592d086a537290263770f5b7edc7f1dc679aaf22dd592763211794cc0433be770ce52b3116a3a9bee9d1846b8c33972a437d6ee73db9d6646c4a16c078f76

  • SSDEEP

    24576:v/1zRDvw29GtsBaF0wqlK/qhgT/qLU1GYlafA:vtdw20tP0dlYZ/qLUWfA

  Score

  10^/10

  formbookmd02discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2