Extracted

• • Target

    78b3e10f355de8a780c69cc622dd3bc529365ff5fa141eb291112ee7b2ef2a94.exe

  • Size

    648KB

  • MD5

    cc42d6edd3fc5e953bcf59b67c31faed

  • SHA1

    291ab6d36c851cbb00d2c344c10abaea8c4f22c0

  • SHA256

    78b3e10f355de8a780c69cc622dd3bc529365ff5fa141eb291112ee7b2ef2a94

  • SHA512

    1c1da806e86a09b7f8a4370e30aa4446ec44328ab102a2e2a18a72c393387e7646b2a1ebfa856df05b1f5039d15e9d4794e5b6777ae1e624e1988077e485950a

  • SSDEEP

    12288:QnCkUsRlS2acxpYc9UeeXBeU8ni8nkZsqgElVRkycQqWy+SkcmEaglKkR:GFec7YcTFi4qhlWWy+ScEaq

  Score

  10^/10

  formbookt94gdiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2