Extracted

• • Target

    2069c3254c5a28daea136f39db600c179ba421e70f71cdd5765575012eb42d42.exe

  • Size

    644KB

  • MD5

    6f845ee182e5a20dee93f871cab2a266

  • SHA1

    31727f824de2990c70c664a9fc9e426110bb55c6

  • SHA256

    2069c3254c5a28daea136f39db600c179ba421e70f71cdd5765575012eb42d42

  • SHA512

    43181f79394b016849f1ae2d1cb20e3c646a3fbb64bdb6ddc141056c1f8c9584feefa5b454a0d422eff5f9bc813f40267071a429411efe6b6f0176bde94ff7a1

  • SSDEEP

    12288:Ui0HRS/CwJlsNU5LoPzwGNFATXfnBbesGfORAsdH2Q:V0k6wg7PAjAWTt2

  Score

  10^/10

  formbookce18discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2