Extracted

• • Target

    9a10e3d9debfb494bf65772bcef8c60066bdd7993ab10d3db91f2d7003ba779d.exe

  • Size

    636KB

  • MD5

    3168ee3dd2892e963dcfde07744e9d67

  • SHA1

    3c322883c8e3e662145d3d1c2ab49467b0f22d7b

  • SHA256

    9a10e3d9debfb494bf65772bcef8c60066bdd7993ab10d3db91f2d7003ba779d

  • SHA512

    24eb06885c5046e4bd8ad84933599fb1da02df369b20e3bd05739d7be1bb636f247ab5c4c12098aab17cc0172352058dfa2d154ca3dc7a236b6f3af5fd7ee145

  • SSDEEP

    12288:zdywoIc0gItbL8bVwL/PQvm71slBpo0BM5dKwb460xh9WOeM2Bi:zkwoIc0gIym7MflBpo00dKwxkDWz

  Score

  10^/10

  formbookpz12discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2