Extracted

• • Target

    2d9e008828a19f6329b2ca4abcfdefa9b124e1eb5eb3270be8b6f1f77476b3d1.exe

  • Size

    1.6MB

  • MD5

    fe3ab433cdc30a005e1616af15a6b0e9

  • SHA1

    a7d6e4d912d4d5b4dbfd0703a8af467d18f7b4ed

  • SHA256

    2d9e008828a19f6329b2ca4abcfdefa9b124e1eb5eb3270be8b6f1f77476b3d1

  • SHA512

    a3c14f1568054ac17c6e8ed4cd0b811013bf6ddfb4d1e309edcfca7b791d122866db4adb621932cd6b762742331662b64f3ff1832b7c31fbffb191563ab7f75e

  • SSDEEP

    49152:wAodtaG9kS2U84B+FLan9k5TRM9zloVj8Hn:Q/B1r

  Score

  10^/10

  formbookgy15discoveryexecutionpersistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Adds policy Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2