Extracted

• • Target

    f8353eb981e7fce8af5663a30b6ad844d44d7eda87ff717f85f0046e3c065985.exe

  • Size

    696KB

  • MD5

    78191bea1a20b3b4fcb10ec3e83510ea

  • SHA1

    ea8463818f2ea00bb5adf46179e296946b8eb906

  • SHA256

    f8353eb981e7fce8af5663a30b6ad844d44d7eda87ff717f85f0046e3c065985

  • SHA512

    71e958bcaabdc2757285b1fe9fbb3425b14851ea7d5f598d8a2629fc5abd1afd3f3a29a15cbf35f57a4c60ff5d6291416eb65b7ac1b603fc84d60e5d72063b0c

  • SSDEEP

    12288:FBxCwgqaVoufINdjswYS24YFMsTMk86/FrwwZt4u5RuInHTDxM1ccL30Pl2:FBxC/qaSufInswZYFr4k8wrwvuD3sDK

  Score

  10^/10

  formbookpz12discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2