Extracted

• • Target
    efab4e467f93e1f5b3f0fee251844f6e3667b794aff5fde442d7b4db955201e0.exe
  • Size 584KB
  • SHA256 efab4e467f93e1f5b3f0fee251844f6e3667b794aff5fde442d7b4db955201e0
  • MD5 f40c29f77e42c8774a6c7ad067247456
  • SHA1 63399cf34c13d7f79415f77f54814723f642d5b7
  • SHA512 0716c5f5fd495f3eee0eff968db5fe3ea9378406374d43a0d1a00664b050881a63d06d84e37a5612d699318d445109f54f163c9ce4842c1638bb28b095570dbe
  • SSDEEP 12288:WnfqVxIIuOao+wJhMm9JnqxT5N/cO7GGZMUsXbKDtPf4O5x2G:WnfquT2hH9581NUceUsLet375xz
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookby21discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2