Extracted

• • Target

    5b644735c25773e7d18a70b9d20495cf8c0cb8a2541e07e76eda4541d73ad4b2

  • Size

    551KB

  • MD5

    2f78dccbe8abc17da8e0a34e33bfdd13

  • SHA1

    b8d7685e0e295d2cb15f383bca20388782a1b263

  • SHA256

    5b644735c25773e7d18a70b9d20495cf8c0cb8a2541e07e76eda4541d73ad4b2

  • SHA512

    84c8b4534933d95a60e0bd99e0555d0a6878bf3e8ab4fd3b958d9345e6799fc200c46996803cfbbe60065e3cae66b016db6279682c5dea49ebb0911598c34840

  • SSDEEP

    12288:KBkp8H/HECC7NEh9x0/2DFc/dlFypqCtaBndBp/fTr:UkpO/ECC7A9x6llKq5R

  Score

  10^/10

  formbookg29odiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2