Extracted

• • Target

    e42abe36559b21170e153807df0fb9cf9191d45fecfa496363932168b096976f

  • Size

    772KB

  • MD5

    08244e9ee6f648ab271e03363e40658b

  • SHA1

    9d1a47abc8bc38db0baebd8eafb97e0bf517b99d

  • SHA256

    e42abe36559b21170e153807df0fb9cf9191d45fecfa496363932168b096976f

  • SHA512

    c6b97ac77f707e5dfce93548d94eadd005e7b2f607d49b578c61fa8dfb4d0bf576f78ce7cb2fc586c8b8dbbb5f292675d56572dbad586ffa295a6e6837273039

  • SSDEEP

    24576:cJhnHi559Vjb6YsRtBMUWKOqs3dMUUUPaVVnu9/2M6GMR:Am9Bbxs3SIOphbPaVVup2MJM

  Score

  10^/10

  formbookm17odiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2