Extracted

• • Target

    malw.exe

  • Size

    590KB

  • MD5

    bf6825aa4d46ea7bf5368dccd8cb7681

  • SHA1

    acc0867bf35aac76f89009eab0d67fb6182246da

  • SHA256

    e646286ab06f7d1cdaebd185c1f72d48bdda8c81830629409cfdc04bef50349c

  • SHA512

    51e800b3cf639f106e79b1a271353ff4277fcf5fc77745a77e9017a9a3029115fa106ff28514a1104174fc700eca3e38f7cc9ab213f61df324f1e3cb0afa6531

  • SSDEEP

    12288:Uh8bQbrxKlcjdOliPwsSpRYAKrgCqZKVvsABefO5fw:U+I9kiPqR/04KCABem

  Score

  10^/10

  formbookbc01discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2