Extracted

• • Target
    d079862ef124c7736c9321485c30fa19a7c944ac81bc683d123c1aa6c50414a5.exe
  • Size 586KB
  • SHA256 d079862ef124c7736c9321485c30fa19a7c944ac81bc683d123c1aa6c50414a5
  • MD5 46827077a4c07d354de20e2e85e06d4f
  • SHA1 056f6f4f2dc98b4d184408377f91cb4296030245
  • SHA512 ccd3b5c9acab1024fd0b11876b0716c0839d9e308a9a854ed2b93bb6a22f06efa4826d0d5a4ba23428d12f25290d4fa5bb35992dff6b7b004ba6c1eca91b6a05
  • SSDEEP 12288:c0nsD9cyVPu1VOsaA+0/vOamqspcedULkqnb4:vnccydu10BOsp9Zqnb4
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookmd49discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2