Extracted

• • Target
    44ab353624b9e867ae31a0523437ed8e321f361d248b471c15bd2902255280f3.exe
  • Size 651KB
  • SHA256 44ab353624b9e867ae31a0523437ed8e321f361d248b471c15bd2902255280f3
  • MD5 1660c33123052f15e4e63891f23ddd1e
  • SHA1 3b93eb0499260f494066d6a28f1238c1c440b04f
  • SHA512 6c55d8bcfc60d513ae59cae83eb0ec0ee4b740dd0305664f3997fd9758104e79238d8f9304345de94c9b76ed8c6fd03f8e66ab72c9f49d55d8a18b5388b58351
  • SSDEEP 12288:JMRkVqoYve4eWCRO5W9Se/DETPCvTtQdH41lIaPLLrR:eRkVPP49Ip4ebELCvJQx45V
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookdn13discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2