Extracted

• • Target

    1c2b963220cf175f77391b7fa2e2f27dc835144750b9c3c0c4c6ddb2e1cccc45.exe

  • Size

    810KB

  • MD5

    1ef4bea7e85a298fa206c826e4783587

  • SHA1

    ccf0d6221459e4028b9c4df80ba05fa65f07ab61

  • SHA256

    1c2b963220cf175f77391b7fa2e2f27dc835144750b9c3c0c4c6ddb2e1cccc45

  • SHA512

    497c69d5a34de478c74209557f2f01b030bf1ec1be50ff00cf1c40f15948e4b93faebd929af96b66a705d8d1bdea135653c3681e8fb17abf5b345d87cb1d6411

  • SSDEEP

    12288:SyfEAUjuLCSN5Tqo1OD8vlOXW+Gbgc5W1wE1I9z3Y2BVGtweePOGLgVSFO01PN5:7HqNAvogsmp9sseeHgVSPP

  Score

  10^/10

  discoveryexecutionformbookcu29ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2