Extracted

• • Target

    z8eokahasflcrscooplasb.exe

  • Size

    651KB

  • MD5

    1660c33123052f15e4e63891f23ddd1e

  • SHA1

    3b93eb0499260f494066d6a28f1238c1c440b04f

  • SHA256

    44ab353624b9e867ae31a0523437ed8e321f361d248b471c15bd2902255280f3

  • SHA512

    6c55d8bcfc60d513ae59cae83eb0ec0ee4b740dd0305664f3997fd9758104e79238d8f9304345de94c9b76ed8c6fd03f8e66ab72c9f49d55d8a18b5388b58351

  • SSDEEP

    12288:JMRkVqoYve4eWCRO5W9Se/DETPCvTtQdH41lIaPLLrR:eRkVPP49Ip4ebELCvJQx45V

  Score

  10^/10

  formbookdn13discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2