Extracted

• • Target

    d51a931d02c9c1f28ae1438b42061311b845aa52939faa31027788c8f9aaabdd.exe

  • Size

    586KB

  • MD5

    ab60967de5a9bddba38fec02d5a3c900

  • SHA1

    adc7b5b4968d4cd5c8eb93e1d2629480726f2b37

  • SHA256

    d51a931d02c9c1f28ae1438b42061311b845aa52939faa31027788c8f9aaabdd

  • SHA512

    439910d062cedb9237142e0c0bf8979f0d46229fbd670838a6fcc0c096019b9074767ea1233a13dc2d0d1ffd0d797faad52e1aa89b6ab9887cd5509a73373dc7

  • SSDEEP

    12288:U0nsD80+C/vmwf3PR7alWqgvZSmFiG92PfVGDr5OiL:3nR4/Zf57al1g192gDr5OW

  Score

  10^/10

  formbookm17odiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2