Extracted

• • Target

    cc26ada85077302ef9080462b8796675c1aa19292b76cde1cd74440b97be0133.exe

  • Size

    773KB

  • MD5

    fa58a4ba59a99dab6d6099663822aea8

  • SHA1

    75c28f6eef865a4beb085b2910f7c8ec599dc4b3

  • SHA256

    cc26ada85077302ef9080462b8796675c1aa19292b76cde1cd74440b97be0133

  • SHA512

    d4d3d5c4347d79896f1190392d25dc96e5519686149f5f35f044093c60386d16c06a81e2bb01839fe7a01d11697fdea5d8f5a5839490aab6846402089adeb51b

  • SSDEEP

    24576:VmMt9lRuEDUgbwUCGnksyrlKNstj4Pif703F:0Mt9lRu19Alyx4qj1gF

  Score

  10^/10

  formbookdn13discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2