Extracted

• • Target

    5181d780e379847bccf22e5cc55b1bdef5c390b78812fb555fb68f042400fd3e.exe

  • Size

    603KB

  • MD5

    dd1fe024a94e2a33b1faa7b03d1c1988

  • SHA1

    315a3c3daf9da89cc8993c85302d0d284f1503ea

  • SHA256

    5181d780e379847bccf22e5cc55b1bdef5c390b78812fb555fb68f042400fd3e

  • SHA512

    185818b975ca406fb9b73f097fbdfd67ee5293f31174a18de22a55310c2f87323d9c2c168651d6fb3169e7587c126b999b8b556a211d56ffef7e52b48ab929ae

  • SSDEEP

    12288:YMyCmE+jjMD0fp77MHyT+XnI2aOkqQr8XSqN714ITNV1oDJIxU:YMyPjMIfxMkgI/1qW8DvBoDmx

  Score

  10^/10

  formbookm17odiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2