Extracted

• • Target

    malw.exe

  • Size

    581KB

  • MD5

    1728a3584f50d156a0cff349e336fcaf

  • SHA1

    2a96f905684aac4d25f550f8121e08cf52bcd170

  • SHA256

    d8829590bfc10cebf2fcaed57649932d199832cbe2a31bae2368d7d675a7002d

  • SHA512

    56512a128e47bb296d82ea861da5ed694cecac4a726a8c1ce5b12ea8fdd34b22c7b8b632f57e1e30b62d6018cb778117b7cc60c7d25f0276bab47cbb8680a136

  • SSDEEP

    12288:RzE2jI65WKDq+pmj9/uhvYGgNLU2/8Hf0uzBkhCVbcu9eQ:RzNnlDqamj9/WvYvIo6Chqcu

  Score

  10^/10

  formbookbc01discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2