Extracted

• • Target

    Cf2vVo7XyxupqsL.exe

  • Size

    587KB

  • MD5

    0e4215aade422aeb64ff45d5712adc7e

  • SHA1

    66303d555188ba6124021b09b3291b1326090ccf

  • SHA256

    030d40369b21914a62ecd144abafc689073ac077c5481e4722154e2a565bc328

  • SHA512

    89dfec073a28109fb96da6a0d1a82d520047d3f06a852757b9bb35f15283c7d746060f500969a9474a0fe0d4af8cd2515eedd8167950ef69cd0ee704a8509fd5

  • SSDEEP

    12288:X3OSUWtbmf6juFEqopZXMg3xhEejaI3huYrDV+Zh1u8Djx8kWK2XH:uS3O6jVzMwE0huYr4+8DibK2

  Score

  10^/10

  formbooksx01discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2