Extracted

• • Target

    d362df8d887747b651512ef2007fb4389618e46ee70104374664f124152a4bb3

  • Size

    660KB

  • MD5

    a6be77a479f0d97936649552ee56731e

  • SHA1

    dd17f66145023fb6ec76a9ae6fddd56230fd67b6

  • SHA256

    d362df8d887747b651512ef2007fb4389618e46ee70104374664f124152a4bb3

  • SHA512

    61fdc3ddac9eb78dd5223b54b0293487f5bdf4ad6bdaebe31a6bf185528259369d78bce5bac64966132fb046b7b331c41ef4de735d092b66bc30829acdf7ffd7

  • SSDEEP

    12288:pjNUfQRkg8yfOGArJYyPqd8nedVTorOuJoJYc+/MMmjjPiu1XCSLa0:YQ6gs1LPkPPGhp/CLgSL

  Score

  10^/10

  formbookdn13discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2