Extracted

• • Target

    89fe909020e532b13c7d0f638556c5f0N.exe

  • Size

    715KB

  • MD5

    89fe909020e532b13c7d0f638556c5f0

  • SHA1

    fe6cb48d3d533fd7897cb468d464196eea7be454

  • SHA256

    be33298d1f2c37b6c2af5a9c36ff335017a1109b8c944826885160c63f8e8b3c

  • SHA512

    e9d6a4bd233d89e9aa0060c3207a86948baec85ed308e336cbbddf7440aa6b20465740e3f573a0d66fb8448fc80b43c2d4789f26ab1f7f8ffd3760fc10e1b3a8

  • SSDEEP

    12288:z2+lR0Rc78rtr/tV/PZO8I3MQLi65E4f/tAZkUy0xyXh1Tl3dLHUOWQhZ:z2+Rc48eMQLi6i03UyEWLR3FHU/

  Score

  10^/10

  formbookbc01discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2