Extracted

• • Target

    4a78c8f9b9321dd93c0e1c9e325271c434aa194d67e9d63b73c66c054d44049f.exe

  • Size

    586KB

  • MD5

    01c879fb6063308d10f1958803f5633b

  • SHA1

    691d2833dcc4a2a1f2e8f746f3f9bb5ceaf8cf33

  • SHA256

    4a78c8f9b9321dd93c0e1c9e325271c434aa194d67e9d63b73c66c054d44049f

  • SHA512

    f1fb9fef3108c04fa893111da8c4e52b893a22ddc4cc18f135774c04fe6f0b90e52a87fe251fe0d2f93df9a508dd4f1bdc687dbbe67103a919675cd87bd074de

  • SSDEEP

    12288:U0nsD80+C/vmwf3PR7alWqgvZSmFiG92PfVGDr5Oi:3nR4/Zf57al1g192gDr5O

  Score

  10^/10

  formbookm17odiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2