Extracted

• • Target

    8f61fd5ce3c2fa9186c75e703ce9e38d66538b9fe2214dd78d2df4c2c7cbda1b.exe

  • Size

    771KB

  • MD5

    a6718dd552a34001f40ced365b16d1ee

  • SHA1

    f40747dd6f9bd62751bc2b9734dd5bbe8e92723a

  • SHA256

    8f61fd5ce3c2fa9186c75e703ce9e38d66538b9fe2214dd78d2df4c2c7cbda1b

  • SHA512

    fbca66394755bf974e7abe6f215048e7f19ae2b9630036e0e04fc2e420332f2f40f84de4dfb78b65c41f9855dd3963513efad1395a5cfaf73616a0dfeff9ddf5

  • SSDEEP

    12288:RblmTdKCcfCQtVKr2hXFn+8WnTN77B2qjsH0y:xlmAdE291+86d

  Score

  10^/10

  formbooko17idiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2