Extracted

• • Target

    3e26ebdfbd46dadcbf46c199970362689fa6ca0e0abb65ec703ca21d08b7269f.exe

  • Size

    661KB

  • MD5

    42d6700f5272596c025308992d4fea37

  • SHA1

    09db89002aa3793dfbf04ace1f62eeef11086415

  • SHA256

    3e26ebdfbd46dadcbf46c199970362689fa6ca0e0abb65ec703ca21d08b7269f

  • SHA512

    e8175443f45089dc9977ff570b3214921f2a49fd9e097fca6a87494021a7a24eaff75ff497367d7ca3c675cffb321e6c9f98b3a62cbac820fca4ec73b1792e6d

  • SSDEEP

    12288:h54hoC7N+VZp1YFtATOWVVT+dcL/BeUO3kR:27yZAUdVT+dcdOi

  Score

  10^/10

  formbookc24tdiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2