Extracted

• • Target
    z1____________.exe
  • Size 676KB
  • SHA256 2efd54686c3942f7778ae4ad63c002e50d1fd2a08fac36ac770dff40cb3e3788
  • MD5 57d485ab07368d3d7fbd1b62b8bb6a5f
  • SHA1 15749ab51781854689d73a7f7a94d6052546fa9a
  • SHA512 7abdbfad7c6ba7956b580c6656d4224ac5023c6df7754a35025bd82b6190f543cd35bf220e3130070799599b10b7b017e2a262d971fab29dd62e2c372a4b6118
  • SSDEEP 12288:vrOd+Ri3AgFd13C1/CYU0EY5ZLl2YFye+JwP78lprlDfB:tQ3Ag13EKx0BR+2YlppD5
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  discoveryexecutionformbookdn13ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2