Extracted

• • Target

    a3a0f6ef77d8d2270b5baac5ac9185bdf9e30351e61cb6f7a90c76601e004b15.exe

  • Size

    600KB

  • MD5

    a666dc5c6765f6912878fc840aceaf82

  • SHA1

    9f804c5d474f723f6c08cac07569c237c25286a7

  • SHA256

    a3a0f6ef77d8d2270b5baac5ac9185bdf9e30351e61cb6f7a90c76601e004b15

  • SHA512

    4835ff70937f9b5f0da3e2ff61126255b1da74e7c0be00654e062b9b5463ad10380b1e2952c7ccaf05d9090a03c8a020ec6baf6cd7b3259ab54e3de57582553b

  • SSDEEP

    12288:hhr8bQb07Lo2kJc9SkHKksvXYXaGtfTiGEXV9JT6newNcGn:gIEcWSkMvoKGtfTiGAWqW

  Score

  10^/10

  formbookbopidiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2