Extracted

• • Target
    f8353eb981e7fce8af5663a30b6ad844d44d7eda87ff717f85f0046e3c065985.exe
  • Size 696KB
  • SHA256 f8353eb981e7fce8af5663a30b6ad844d44d7eda87ff717f85f0046e3c065985
  • MD5 78191bea1a20b3b4fcb10ec3e83510ea
  • SHA1 ea8463818f2ea00bb5adf46179e296946b8eb906
  • SHA512 71e958bcaabdc2757285b1fe9fbb3425b14851ea7d5f598d8a2629fc5abd1afd3f3a29a15cbf35f57a4c60ff5d6291416eb65b7ac1b603fc84d60e5d72063b0c
  • SSDEEP 12288:FBxCwgqaVoufINdjswYS24YFMsTMk86/FrwwZt4u5RuInHTDxM1ccL30Pl2:FBxC/qaSufInswZYFr4k8wrwvuD3sDK
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookpz12discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2