Extracted

• • Target

    45bac0cd4b709400f6801f0b6dfaa5eba1d6125d3a859ade0cf2a1e53b637746.exe

  • Size

    637KB

  • MD5

    536f359f5908b1a9926b6337c3e520d4

  • SHA1

    d8b7aa1367b6508e1e4ee99c5e0ba9d15b097219

  • SHA256

    45bac0cd4b709400f6801f0b6dfaa5eba1d6125d3a859ade0cf2a1e53b637746

  • SHA512

    dd1c82dc5779f28c33fd8d82b44a9000be1643213c1bd0d68968697e8ed24578f713724300ee73927efe058166dd00344f7e7057a44b2db6cc69efd86f8bdf14

  • SSDEEP

    12288:YvgQpjndCDRIswmfdJ8hWUxE/350N2mDuPZgC5uvqpkqZiBXdQdkR:YvvjdCDRLH1UxE/35tmDuPl5uvRqZitT

  Score

  10^/10

  formbookss24discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2