Extracted

• • Target

    9f17dfb2b539dbfeae4eff938a67da34bf07b6d9617c49963ec4b537449f7520.exe

  • Size

    637KB

  • MD5

    f48f1b6145eb795061ee91642a07cfa4

  • SHA1

    5d8ab68c809005ad6495b04e3fe11e306ee71cbd

  • SHA256

    9f17dfb2b539dbfeae4eff938a67da34bf07b6d9617c49963ec4b537449f7520

  • SHA512

    69164b98afc612343d1eebd1d98ae544b1954bbaacb9444ceccc16894027f89e5eb3b7b807f7e24eb3fe7e76a829d67d93642c767d40d88c6e1d2f9013ea2a44

  • SSDEEP

    12288:8I4QpjndCej981lKV+qspbem0HFnOXKizT3i/q8re+JvvYnQckR:8InjdCaKocam0HFOa+SQe

  Score

  10^/10

  formbookss24discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2