Extracted

• • Target

    31e72c74ceffd7ffed03d6759c179cabf172f41a8a876a33d60080c27455060c

  • Size

    657KB

  • MD5

    e38caf7ccf443119181d0b739da5bea9

  • SHA1

    6dbc324c29f8d9e200ec19f109359b8a18a05a6c

  • SHA256

    31e72c74ceffd7ffed03d6759c179cabf172f41a8a876a33d60080c27455060c

  • SHA512

    32e273fba187ebf146988ecd7029df7ea5242107abbadb39c1b055de2b56345d506a49cbf10974e55066db84ff97cc92f4a3624e8ef53753c40562bfebd35e4e

  • SSDEEP

    12288:V4A1sgWxpBfcLbTCMsQO2qMc6/tnukBQ82uh1LPkV9:KGApBuTbnd/PQJ45k

  Score

  10^/10

  formbookhy08discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2