Extracted

• • Target

    0340ee93c6adaba408464c326971c10553cff304c7907dc866aa9c61ddf08c1a

  • Size

    604KB

  • MD5

    22312f256e00ec3f88032bb2b470ace4

  • SHA1

    ace5a31efd86da464959154e3dd6cbae632dbea9

  • SHA256

    0340ee93c6adaba408464c326971c10553cff304c7907dc866aa9c61ddf08c1a

  • SHA512

    c716806c037f8fd0bc62fc0e279bb50acca6998286d95c72fe0f0c5d415ad8652ce1808bb15e1390aa2515a6e2a3d062e6843da7672c9a4f355bff81d6f4f9b1

  • SSDEEP

    12288:AVV5LuH5DJ+A6WYi4feB7LclGq0fRj0b8A/RthPntidYsg6B6b5wedn:C5LuZlRY8hcoq0f5aLdtgjg95L

  Score

  10^/10

  formbookhy08discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2