Extracted

• • Target

    2ba240529791fea8319f1ac0779d58b0bdfc7c9d83abca2936e3637f77a3da3a.exe

  • Size

    671KB

  • MD5

    08e03e1ac072ae4e33b1483cd77621e8

  • SHA1

    c349bb0f328ada0a3324ff01d4159aac2c591017

  • SHA256

    2ba240529791fea8319f1ac0779d58b0bdfc7c9d83abca2936e3637f77a3da3a

  • SHA512

    656b6a16ff32ddb4afe7dbbb143914e0dcba6d1649b4e7e79b644f950f90d1cea29c3de3c81eaef77cd2bc2aada3eae322538aad1d51a64e65cfde26984448ba

  • SSDEEP

    12288:1A1tMlqW2L+IRadx/4fqYS8R6FBREVrRFi49hkR:1GtMGL+IRm/YqY1R6LiJry

  Score

  10^/10

  formbookm49zdiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2