Extracted

• • Target

    8f7124624844c97145faad6f265f2a15b5f1fa67f107168b61fd777d987d9f35.exe

  • Size

    777KB

  • MD5

    a5669db61177ca1feecf910d876cb2e1

  • SHA1

    929046215d3fa65992db255dca3885ba9a6d7cc7

  • SHA256

    8f7124624844c97145faad6f265f2a15b5f1fa67f107168b61fd777d987d9f35

  • SHA512

    0ee38f1260ad234919ce1195ec495f2eb60e2b7063dffa83fa074b4eeaa386a405705ec9a7ac0c388a62cf0a8722e386b09d11e3b1bf936884888580c9cba469

  • SSDEEP

    24576:DEhugrVbCx3YNCgUTMw3NvklTPG06EPpXRaI/u9q9dUwZm:NglCyCgUMwhkNPUEP7aZ9hk

  Score

  10^/10

  formbookt18ndiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2