Extracted

• • Target

    3335faabca6c9f12f7f1086828065cd19f491a6b705d4f7fba8ba6f53a3c5d87

  • Size

    586KB

  • MD5

    a7366314c2008fc40e3a1de0add37e35

  • SHA1

    997576c272d4392b43a36bc195e7ef6fd9b3110a

  • SHA256

    3335faabca6c9f12f7f1086828065cd19f491a6b705d4f7fba8ba6f53a3c5d87

  • SHA512

    d48f1df0943221b0dc5c28e9a5d614e364f51659de880d4000d8a703068babb33315634af862b70efae27ae048e6f96b0cf4a32d8000e4eed9c73a6b6f3faa86

  • SSDEEP

    12288:U0nsD/ZqT+LEor6T19B8w7tUJ9ElWRM0Hsxipf6Lk:3n8nEorcnB8wZUJ94WXdd6

  Score

  10^/10

  formbooko52odiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2