Extracted

• • Target

    gHALCP5u6qYbIzp.exe

  • Size

    571KB

  • MD5

    d46ea4a5851ace640a9f1ac3c3304e83

  • SHA1

    3797c494b69de4c08d57e18d75e744196662d932

  • SHA256

    dac46f3d278ac47faeadf5160565437d7abcbdc42a39a40482a12728dc088226

  • SHA512

    f2927da84a4abfffe27761ed19716e548d4ae89d8cf0377314ef665980ff5956959b3447082b7ac247eb967ee49f20827b1dc7bf5b282973136c14709ad44ab0

  • SSDEEP

    12288:/Hue0mNiwsiOORw9/sRU/XeL4fc+0eDr0orT77/Knj5jFbSKlHpJ0zW6iFw02g:/OOiwsiOtcyP0ePRP77/K3jtoLiKJ

  Score

  10^/10

  formbookc18xdiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2