Extracted

• • Target

    7179dd3ea3dcfc1521895d39342c1ac03da908b0baaabc358a1caadea9123a95.exe

  • Size

    633KB

  • MD5

    596c94c19646225e8bb24d7a95cc9537

  • SHA1

    c917031c6b6401080e4d0c8eb08b002608d6d8bb

  • SHA256

    7179dd3ea3dcfc1521895d39342c1ac03da908b0baaabc358a1caadea9123a95

  • SHA512

    b82eeee86ecadf931a627677547a7b76ff67b09483cce3b330447f1595ca9d3e61bbea2ff09e2eb1abab57e74c3d530442f0fdcce051f7faf641ea4d227f9f9a

  • SSDEEP

    12288:PXm0LA8PMyhx7WUh0Mzgn1I9CYeXRU9/YZl/ycoInCRngGo315IeypRxDxD0F:PA877WU3En18CYeXq1KL4nv615Ijo

  Score

  10^/10

  formbookdn13discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2