Extracted

• • Target

    626ffcb054c33c59e1caa726e5a71f11f2e6dc81a982afbca8820e09ac7929b4.exe

  • Size

    641KB

  • MD5

    9347166b9363eba1d20b7730637c5e1c

  • SHA1

    25939d1eed435a46a545f5c648ebf38a89921809

  • SHA256

    626ffcb054c33c59e1caa726e5a71f11f2e6dc81a982afbca8820e09ac7929b4

  • SHA512

    5b23fa987ee3797012c477dd31ee8721907c49c93e476bca719b3a73cbf87960012840eb749fadce22c0e9d9a6719cb145ad5675cbffcb51116732704d0df243

  • SSDEEP

    12288:QmjQpjndCgO+a8OJnBQs5t54KP015K1bnK2y9979RzAgmU/qUYQ4kR:QmojdCMYBQsr5DYK1bnK2y9VLzA6/H9

  Score

  10^/10

  formbookss24discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2