Extracted

• • Target

    2f1628d8b8fc177731b898fb0a6d1bc871f4da59e9d0669b368d0e4e7d20f891.exe

  • Size

    768KB

  • MD5

    5aa8233ac59851776b9bc4f60c995752

  • SHA1

    ed7a5b480b9f15feb6827f5053b10bdbf8c97ab6

  • SHA256

    2f1628d8b8fc177731b898fb0a6d1bc871f4da59e9d0669b368d0e4e7d20f891

  • SHA512

    1aa406e8ef185796090882380e5f6165e559c9a520ce949ccf9ea604f7b56abd4918355aeab6ed5e8ace60c9e8c155b6d84ae7a9701caf17a4354289885ba3a8

  • SSDEEP

    24576:iZMvvzf7yduCoa9PsV3wEcru7OcHJkyJ9:iUvzfugCoaZ23/cCpH6yJ9

  Score

  10^/10

  formbookdn13discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2