Extracted

• • Target

    Dekont_30.exe

  • Size

    804KB

  • MD5

    853048d16c237765d3c0ffc07f9b2879

  • SHA1

    a968bae9a55244d7de1a05b9e59254648f3815eb

  • SHA256

    6153e389b9e4df22730eddb6f964c640e98661a45fc4578136dd6a33bb821fa5

  • SHA512

    aa1376ce2a46c0772fb9d7e530669d05332656316be5dc4236ec4f4d4835e8ba3fa2debeee6d6644e9e240ec3fdf6c3a4e09eb9c1731d730094ad5ef10b1ebe8

  • SSDEEP

    12288:urCkyCZMiLZ31cch3sln0h8KvqwB7UWg4kHpC7cVZH4:6yClFdsEKP4u+uY

  Score

  10^/10

  formbookbc01discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2