Extracted

• • Target
    a99e96240277999d6ac2c51b1071298e9488a4e08a24f3ac934c8c1d5f68fa0e.exe
  • Size 586KB
  • SHA256 a99e96240277999d6ac2c51b1071298e9488a4e08a24f3ac934c8c1d5f68fa0e
  • MD5 dab8524799291672da26cee346c4dffc
  • SHA1 c6a796dd80af49571da33151594ff87268587473
  • SHA512 a70eb0635b1a71baf8efa8495d073b2a37e692d3fa87ab12c977d7f45ba90b0f042927b1faa99e19ad8e15b92ce76cdcc9fbf5293db3a12fc2d55513ce06dd8c
  • SSDEEP 12288:To0nsDOVMMVJBTYeA8paM0C8da9lrVxSZEPnag8n8xcNWe1WbPkdG/m1sCSs2m:Pnp6JKH0F89fCcaDnPRhsCz2
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookmd49discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2