Extracted

• • Target

    image_00yu.exe

  • Size

    684KB

  • MD5

    5b671e65052b9fe3672bf5671193a415

  • SHA1

    42e2cbed170357699d64541d458ee4bab1c9e04d

  • SHA256

    8b4af4f4e4ff7945788cfd890de28517157ebbd54b28561b02eaa4774a8c6573

  • SHA512

    008225e7dcb3a9241c465a7f356c003758004392b3fc5aa777151ccd34c4fd602bad6f839416af9bb0960a2d08588c6b80ac375499b07c1f05229a256a758f14

  • SSDEEP

    12288:v2xu/Zx7GpuKjGAes2CEo1xBPuE8/ygGt6pQeI9usAtZGobkkN++KQ/YRjIkR:eQ/7I3xeuEQLcyrQ99tAxkN45Nf

  Score

  10^/10

  formbookrn10discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2