Extracted

• • Target

    e7053ab2745b3aef0e16e1ab0511cac5ba91a5ed9e3437b0eb4fbfbfd013295c

  • Size

    601KB

  • MD5

    c25280d4d72a9236aa54d2ada91645cd

  • SHA1

    5001b704caaaffcbd48f6c78ed99afe29f8e469f

  • SHA256

    e7053ab2745b3aef0e16e1ab0511cac5ba91a5ed9e3437b0eb4fbfbfd013295c

  • SHA512

    c875265984425426253d837558bede69e896aee3db7e4a58da9dcad37bf2731bb2f476efcf798bd6d897a2f8b8961e3f7fe716327c91b43a70f346a286b564f2

  • SSDEEP

    12288:DyA9eCYHvr/f5YA1615nrKusVXBd91F8CVjxQag/NXA:2XlYAU15rKHVH91F8Chs

  Score

  10^/10

  formbookhy08discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2