Extracted

• • Target

    document.exe

  • Size

    663KB

  • MD5

    9806b5ef6bf254fdd4c0e934a4c070eb

  • SHA1

    caa33c5cecee0b8a05a4b1c5f7f4f4c081fd0b77

  • SHA256

    c01d1b77062d28f497480aac1c2ad019d88b9f12a8db4405065cd2a9f3086191

  • SHA512

    824ce46df91db025a3e2fea193c394ad1290c681cf46e39b163036693d246078a2589eb34b56ba1c9ea62078e2b438477f7ccb292c469a99da55b79306a8385b

  • SSDEEP

    12288:J7C27Jb5EMTIRjAH5rV20hkoJnnFc8AtAvJIUHTrU2fujnR/C6CqkR:1LTxZrLh9Jn68At+JIUzrcjnRip

  Score

  10^/10

  discoveryexecutionformbookt94gratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2