Extracted

• • Target

    a2c0537782a8c28077337a873813db9211330a95725e641db956183db3252241

  • Size

    851KB

  • MD5

    315b8465e215b51916f253c741a98db8

  • SHA1

    5e39e3d2b9a9445e352758f83282175f2636fa70

  • SHA256

    a2c0537782a8c28077337a873813db9211330a95725e641db956183db3252241

  • SHA512

    ca8590ef803c0fdebf9527b309fc4a3464ab5a7241d7b6b4eea763308d8563d380ad556a49f8b09b335f9a7fef494543f5cfeab965abb5dcef062fb8c0a42c76

  • SSDEEP

    12288:jTfWpmLKE2pb57IG9Kd962BfCqfqyI9jADIsLINHn0J7pCIhdDZcCdAtBXVb:jV2t5sG9s968EpjADIsyn0JVpDmtBX5

  Score

  10^/10

  formbookrp26discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2