Extracted

• • Target

    nmGdVmAxebb5aEP.exe

  • Size

    729KB

  • MD5

    8f2603c9822b7e98f2544b83f7ad6b55

  • SHA1

    48f8dde1f2db0d50abcbbf0fe461791a51068ad5

  • SHA256

    64a9613231cf8cca0624c38a480986b8ee7726390aeb3c662698fd9e156315ef

  • SHA512

    0719d967f49bb27d11821662b2b78c39919929ea4a08aded80b2dd979ca74705e00b7f8c8444ccbf5fef56d413bb1253c61556bd7173cea18795078b10e394a9

  • SSDEEP

    12288:QeiOX6A1n0YcGAOb6CMwlBvN2v9C++3YRxJ/GpBg2S:QeiJGnHAOb6CbZh3WxJ/

  Score

  10^/10

  formbooksx01discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2