Extracted

• • Target

    d61bd347f131dcfe85ed71623854fd4b.exe

  • Size

    567KB

  • MD5

    d61bd347f131dcfe85ed71623854fd4b

  • SHA1

    10f1af7c65c72c1d0c97b144fa1f1e07eef6a196

  • SHA256

    689f9349a8558c9d99cf0f6131fa14cdb7f26e77c5f79de66695ab5d970b2759

  • SHA512

    2159406ce218f6cb3cf765bf4e3566e066914dcbeadb53bf50618aa6df708550215e848916245d98405d583f225128423b6217ad4ef1d66f68676a7f6385a198

  • SSDEEP

    12288:lS316A0v1ZMBevrNZnx+BjysXkZ4kKVjhS4kaQrp7iWRbTySe:la0VNZgYrbnAhLO+hS4kaQN+WlTbe

  Score

  10^/10

  formbookbopidiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2