Extracted

• • Target

    d00473faeb52860f46c2f850f4bda73473b569a3ce79974b909c4203b63dcf95.exe

  • Size

    615KB

  • MD5

    f0142832d1b4e1f42481581898dba2de

  • SHA1

    a0dfdb329bffef7304d615a3a1f746157a96725a

  • SHA256

    d00473faeb52860f46c2f850f4bda73473b569a3ce79974b909c4203b63dcf95

  • SHA512

    7c5970d8aa0a8d02858d6b931bee829479ae59c56a40225c754138c3ae1f15c8856a02aa4c5a463f90ae6ea5e415d644b9fb0fa905ce49172eb26e3cb7ce0207

  • SSDEEP

    12288:foW0xkHyzYiRRxkimhNE7SH65gRr1YpcruYxcC9vjJjGapNWGIkR:fodkHQY2Rxk7sSa5gRpYpcDt9djhBf

  Score

  10^/10

  formbookm49zdiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2