Extracted

• • Target

    ee7dd9158f6175700aa6d58f346036f949889f8deebf8dbee83c40874bbc1f26.exe

  • Size

    561KB

  • MD5

    01fbcc6559c010e59be1dc7b66c12e4f

  • SHA1

    657f058d4032447658f71265803f7a6d52a64532

  • SHA256

    ee7dd9158f6175700aa6d58f346036f949889f8deebf8dbee83c40874bbc1f26

  • SHA512

    8d83eea254360b6fcbb2a83ef6a6d26898a2370c151cdd36fc964509b27b4e5241ebff1d520d6bfb194ce14589c51d2387023ece6858c6a8e6a7634f7418fdcc

  • SSDEEP

    12288:0MHalYsHfne1TDq/MrmqiqaXpSxDHjFB0LobIgySCq:Jaltve1TmUvir4zZuLobSSF

  Score

  10^/10

  formbookgy15discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2