Extracted

• • Target

    fa2a38ee7933b6eec66fed45d0f14e9cb4009ce04d5b56cf7e753af46626ada0.exe

  • Size

    607KB

  • MD5

    10a0eb65b2183e25abb783e188eb69e0

  • SHA1

    86d0693cb57425c210c8e4dc0b588db254fb6e65

  • SHA256

    fa2a38ee7933b6eec66fed45d0f14e9cb4009ce04d5b56cf7e753af46626ada0

  • SHA512

    0cdc358bb6c1781843d1d32c40659bc07eba8e99573f946be6c141de98906511aae598a04ea80f9aef229f8fcf755fc2d53475bed46f89277678072e75681fb5

  • SSDEEP

    12288:s4y2kNXpOEaScZtB/dIvhwg5A14raeOesU6aW6jndC:sV2opOEaS0tB/iZwEY5beuAjdC

  Score

  10^/10

  formbookby21discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2