Extracted

• • Target

    1c50b01cbeaf831465322319b5697cea9f857dc113127439230c86c68ebb6698.exe

  • Size

    667KB

  • MD5

    1b92df39d3abd08b2d627d0d545bc391

  • SHA1

    35f0a75b8a0d975b46977cc7124890f294eb3dcb

  • SHA256

    1c50b01cbeaf831465322319b5697cea9f857dc113127439230c86c68ebb6698

  • SHA512

    a646518ea5da216237889575b750601bcdef7eea7dce1a1d31973f316ed7671a56a6e25a289a06f6f74dd7a209ca9bc013cb404648f6559ee41d73b7cf82d233

  • SSDEEP

    12288:Tcym2iNvVdHy4vCWIFCNUXsgrf+ncaNdR/yXldNWj65QO1qTw1A:Rm1tnXMF0lyGnN/yJESb

  Score

  10^/10

  formbookae30discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2