Extracted

• • Target

    b4a385e3626a025b4bff6b40295656d39310662e23380c5e869b332c48f7b93aN

  • Size

    590KB

  • MD5

    9670e05fd8e4a6fb0b5db5436c3832a0

  • SHA1

    1a77ac485ab8271b77c7a5e31aa7aae84ab936f8

  • SHA256

    b4a385e3626a025b4bff6b40295656d39310662e23380c5e869b332c48f7b93a

  • SHA512

    d74e47e8fcb1c1029d06403c867774dbc563050d24326b83915467f6bb71f7e40cf2656ae839db35802c9aac0e7c7d1fe8c9476a8ef98292b55702b76ef490fb

  • SSDEEP

    12288:Uh8bQbrxKlcjdOliPwsSpRYAKrgCqZKVvsABefO5fw:U+I9kiPqR/04KCABem

  Score

  10^/10

  formbookbc01discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2