Extracted

• • Target
    9a10e3d9debfb494bf65772bcef8c60066bdd7993ab10d3db91f2d7003ba779d.exe
  • Size 636KB
  • SHA256 9a10e3d9debfb494bf65772bcef8c60066bdd7993ab10d3db91f2d7003ba779d
  • MD5 3168ee3dd2892e963dcfde07744e9d67
  • SHA1 3c322883c8e3e662145d3d1c2ab49467b0f22d7b
  • SHA512 24eb06885c5046e4bd8ad84933599fb1da02df369b20e3bd05739d7be1bb636f247ab5c4c12098aab17cc0172352058dfa2d154ca3dc7a236b6f3af5fd7ee145
  • SSDEEP 12288:zdywoIc0gItbL8bVwL/PQvm71slBpo0BM5dKwb460xh9WOeM2Bi:zkwoIc0gIym7MflBpo00dKwxkDWz
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookpz12discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2