Extracted

• • Target

    8762ea652c974bb0aa9bdf338ed57d46c251f72f5f1f4a5bf4d40c9961d8e2ee.exe

  • Size

    576KB

  • MD5

    3577b6781c96341d85c2d789663996f1

  • SHA1

    6b92b743ddf5e0a38a38ecedbc71d5d66dd1a24c

  • SHA256

    8762ea652c974bb0aa9bdf338ed57d46c251f72f5f1f4a5bf4d40c9961d8e2ee

  • SHA512

    9ac422d0c3a23460bcb5299fde784624f0c271385dad05679ee375400b25837ec83a8ef3f579ff5c0283b4469051c6abf0f132ed59264bb20720231defe886f1

  • SSDEEP

    12288:R/nqjqYBWEjmDVEEBFGpfAvAUcpghwG2n2HtgmmeEnHSUh:R/pUWEYBQp4vAUcGCFn2HteeER

  Score

  10^/10

  formbookt94gdiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2