Extracted

• • Target

    malw.exe

  • Size

    751KB

  • MD5

    cd4ee0d6ce4f0fcc5105b1601946d94c

  • SHA1

    a1b22767415d6230e9f2442f75b64a948759b8f2

  • SHA256

    000948ea48835dd2fe087ca6b042eabbf280ac93fe2eb94558995a3a9db0b8a9

  • SHA512

    2565e81816c7896db100e5ade16f456c76ee9b711d672711845b89d578a767077836510185fd605db3eefcdf1a1ced3a56e409bfae42f4f3f954d4f1ebaee5b5

  • SSDEEP

    12288:v39mEqOVzmIJnfTu6EKrVwTBbHsot5ZeVK7EWWlPYnlMWn:vIEqE6sTxBwBtve0WRnW

  Score

  10^/10

  formbookt18ndiscoveryexecutionpersistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1