Extracted

• • Target

    8e185a2f10e620e49f3286683619c50ba26c2197de7377d657462ae039462b60

  • Size

    709KB

  • MD5

    e4f60d72ec802f36b0bf548cebf866d5

  • SHA1

    3062a74ea120d1d6df530198fbee72748c00012a

  • SHA256

    8e185a2f10e620e49f3286683619c50ba26c2197de7377d657462ae039462b60

  • SHA512

    69bc1f57bb13424a8d34bfd5b14f6c3877a5971849d642fd01018e3567d49bf9819f0634fc535647c3c36446f1475092f18db10a998dd884c2b84be10f89c889

  • SSDEEP

    12288:VJ6J0nVj9Eqf84uRggd7Gfl/BIiim7gzTC/OoEEaSOVwkZEgK7:GqiuIug4flZ37g/9oEE1OVw7g

  Score

  10^/10

  formbookhy08discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2