Extracted

• • Target

    f7ed62ff74c9d1adef3366e1db59511d6963804b3e73b0dcf3a4ce31c9bad83a.exe

  • Size

    615KB

  • MD5

    ffb6fd46005b0ff61b57526e2cf970e5

  • SHA1

    2efb36e2a57ddcd3372489664bb713e010399fee

  • SHA256

    f7ed62ff74c9d1adef3366e1db59511d6963804b3e73b0dcf3a4ce31c9bad83a

  • SHA512

    b7d20b3bd3cf74d40c0c82c20195819dce978aa541711e76fa38c9f6b2c8350c4f054d944f6dc346c95b528ff94ccf9f6acfa8d00b95bafa560ea3411da11b28

  • SSDEEP

    12288:8MfzuCBvpHzgnJ4nVpJWxEt5TYPkmSEALKhK/zEDXop:8sbBvJzdVpJWxI6BFw4DX

  Score

  10^/10

  formbookga06discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2