Extracted

• • Target

    cbc824c8cdf2c25b2b4e2f43163f34232ecbded388c7e0c0f01c52b4657e8f7d.exe

  • Size

    696KB

  • MD5

    88295402509cd6179f6366109ddfc576

  • SHA1

    7623027c3bf6394176e98784b598d711698d5350

  • SHA256

    cbc824c8cdf2c25b2b4e2f43163f34232ecbded388c7e0c0f01c52b4657e8f7d

  • SHA512

    9f438650d18c88f198d6e90bae25f8d32ab2dfee0155637c69272b6c434f1970fa542474e807444936833ee9bd9094706dbf3de55dc311198753503a81a12871

  • SSDEEP

    12288:cGZKzvuLBKYvI8yuQoa5afqsEO6KcMQ6y+j45cBrx+qaxI58lRWPxHvMCDtHC4+e:JLOPu1LDEO6K9FDl+qkI5+WpHkCDt4a7

  Score

  10^/10

  discoveryexecutionformbookp25oratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2