Extracted

• • Target

    44f75d2a856166c782dbcee5839ef36c900e8ef82ad1e9c6d3b40792bddc731eN

  • Size

    697KB

  • MD5

    24825bfc3a5271c2ec5c6715cf6f2b80

  • SHA1

    a023d0624490608820f6c9856a7aa8ae7c32666e

  • SHA256

    44f75d2a856166c782dbcee5839ef36c900e8ef82ad1e9c6d3b40792bddc731e

  • SHA512

    051f7a037f32519a758ce08c08f9f7014af5ce01378347b9b9c89eafada5da2b0949f7cfa96e7af84659167d4532275c253a206271cc332c5073037b8013d830

  • SSDEEP

    12288:qlx75hZfmn5+IrAT439F/FNLeJkcMTEuUP6j8qmqyeqgyewovls7+18AY9nSH:k75/f2/A8tBLeJR6EuUlayeqVec7+18O

  Score

  10^/10

  discoveryexecutionformbookrp26ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2