Extracted

• • Target

    ef035eed65c7665830415f30f12204f4a0c2b83a0bb6af5edeaccf57bef523d2

  • Size

    603KB

  • MD5

    fd1dcbb1f74609232fde7b39e4938378

  • SHA1

    854320af37e5728501b936dd0494bd1fc62cdc14

  • SHA256

    ef035eed65c7665830415f30f12204f4a0c2b83a0bb6af5edeaccf57bef523d2

  • SHA512

    30527125491198020fed44960a54d61f462480d8f169ab5e239e92e80c5a98176a0743ef7a40d79f9aeaeea0e1319d6c59a6567d36b6c2cd2ba7f0c1f0735e51

  • SSDEEP

    12288:5DfBbKhaPW6uZ0YTAA+vMRh1b9evQ/8RtkubA/gIeI1fsfaJ:59b99jYTA9Mff1hubAgP7fa

  Score

  10^/10

  formbookpz12discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2