Extracted

• • Target

    c240de1c470b2ba22b8628de9a10b7d81e9f453eb94a46a9d0875f7f1705409c.exe

  • Size

    650KB

  • MD5

    730cde87925272883e738b9eec270c8d

  • SHA1

    4dab428287be9155966e69a8f44fe2001e123df1

  • SHA256

    c240de1c470b2ba22b8628de9a10b7d81e9f453eb94a46a9d0875f7f1705409c

  • SHA512

    10860f548f96cdd2c04ab5a8e5d5cec24b0bd519af3755e7282a0f5e2a4c87cf2e40aa2377080eb995f0f63cae31b1799ac86868bb5c334a86ad55dc1aabb0e1

  • SSDEEP

    12288:1acQD3RbeX8esbnNVZgtW/g6PIlOv7NF8Q+hbncvj4m3XLU4Yrr0r/F:1hQD35eX8DZWOv7NF8Q+Kkm37ht

  Score

  10^/10

  formbookbc01discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2