Extracted

• • Target

    2efd54686c3942f7778ae4ad63c002e50d1fd2a08fac36ac770dff40cb3e3788.exe

  • Size

    676KB

  • MD5

    57d485ab07368d3d7fbd1b62b8bb6a5f

  • SHA1

    15749ab51781854689d73a7f7a94d6052546fa9a

  • SHA256

    2efd54686c3942f7778ae4ad63c002e50d1fd2a08fac36ac770dff40cb3e3788

  • SHA512

    7abdbfad7c6ba7956b580c6656d4224ac5023c6df7754a35025bd82b6190f543cd35bf220e3130070799599b10b7b017e2a262d971fab29dd62e2c372a4b6118

  • SSDEEP

    12288:vrOd+Ri3AgFd13C1/CYU0EY5ZLl2YFye+JwP78lprlDfB:tQ3Ag13EKx0BR+2YlppD5

  Score

  10^/10

  formbookdn13discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2