Extracted

• • Target

    bffdb4bbb96acd911702c208b2b5d92556a26fe4f3b59e9a4a339c353525fec3.exe

  • Size

    689KB

  • MD5

    bd16d4091b49dcf06f79b7dccd8076b1

  • SHA1

    b37fab8b6068f595e54b692318ad87ecdaee0cf7

  • SHA256

    bffdb4bbb96acd911702c208b2b5d92556a26fe4f3b59e9a4a339c353525fec3

  • SHA512

    760d747dea7d69c056a70452e9b0b321ad01cc9b5031d759273e8ecbd46d02a9a9f16ebf7e80c925253ace422ff671006456a604f51d42f825d1fe56bb79d3bc

  • SSDEEP

    12288:1bJbQWSL/h6HWSpws2t0dAWT9ymEtboOCJVMH3:dJbQxLQHWSph2t0OWTgmENoOCJVC

  Score

  10^/10

  formbookm17odiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2