Extracted

• • Target

    37712bec3e83a2af5e4c4bd823e6bc474b121d3bcbac979232e074cf9ec62b30

  • Size

    741KB

  • MD5

    a80b0f238e276d18a60b69987e3971ac

  • SHA1

    505fff2c677555ed2a6faaff2cd070829c1e545e

  • SHA256

    37712bec3e83a2af5e4c4bd823e6bc474b121d3bcbac979232e074cf9ec62b30

  • SHA512

    8dbb433c2f5dcec0bea4579ac475b8c9e9cf26e3cb75aad1e3b70a889331e9ad8eedb735422a5f73496b7105fb4ec5a29acaef3cceeece2edaa526685d752543

  • SSDEEP

    12288:cIzjLf30WH0TwOqp06yaHZQla0tJfFFg4vqtwnZS8Qp7xQ6JtpOQ5tRyMJTQA6OH:Xjj0ywkpNXWlTJfF1CeWxxxT9tRWAtH

  Score

  10^/10

  formbookhy08discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2