Extracted

• • Target

    736b209eebf951e82c1854a0149aa159f609e6bf202225ba58793108cc26ed33.exe

  • Size

    653KB

  • MD5

    28962cf2256813cd85182e59281b8fb8

  • SHA1

    7acfb602f72ae8f129eff2d48b2773a996dadf39

  • SHA256

    736b209eebf951e82c1854a0149aa159f609e6bf202225ba58793108cc26ed33

  • SHA512

    2d19c2c2658df87a5a9a0489d1f91b00abc7c21661420dff0a07c76d88b6fda9565c54e0d7b4a2819fbda0b30678954511fd9c58e1ea3534fc3053ae5fd06aec

  • SSDEEP

    12288:+OrDR3yjNnE8xH1U33/T5nx+sxFbluyY3XSZDoLzZMOwLr9:+4DM7xVUnbxx+s3I3XeASOG

  Score

  10^/10

  formbookrp26discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2