Extracted

• • Target

    1728514626a90de45f2defd8a33b94cf7c156a8c78d461f4790dbeeed40e1c4ac3b9785dda970.dat-decoded.exe

  • Size

    824KB

  • MD5

    681c16a3a587aa1bc8041d068d03c75a

  • SHA1

    8a32b2e4e5542234a43761516751c926795c7218

  • SHA256

    7230fedad9b1999e55841868a75082f735cf510b5c0cd3659746c90ba4d178d8

  • SHA512

    13ba066b977ae3664055fa4a48ec1298cf3beb113e6de4404620bca4b0ba1bcf67c73ea908c94ae6f734dddf4343ab091cf4b7950408c7aa96beb1791d30d2d2

  • SSDEEP

    24576:bq/KMd/wQUyggtrlDMQJQpugkSAyxldMT4s5PF/xT52zUwivB1:WSAyz6Xd/x12zUtp

  Score

  10^/10

  formbookgwdvdiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2