Extracted

• • Target

    80a8456e95438273c852bbd61f5a2556b34373df0b271625371ccfdeaf744969

  • Size

    632KB

  • MD5

    529dad9020611a5b8cd5a74b47291350

  • SHA1

    aa18f23310aa6ca3bf45989d5106c40cf82ba83d

  • SHA256

    80a8456e95438273c852bbd61f5a2556b34373df0b271625371ccfdeaf744969

  • SHA512

    a8abd772c5b44061d49c89c99a44da014510f4c0f87de94df5e142398ade9003a36f4754861e004c83ed8ee5b92399fcbea0088414a987098f75324d98231feb

  • SSDEEP

    12288:Y54hrzUbAV0lDEGy9UQ83xYw+TAjI4P1sN5c0qbnUy1C9JIGfk+5dDFA:jhGAGlPy6R3ifARmN5cpbnUy15Gfp5dS

  Score

  10^/10

  formbookpz12discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2