Extracted

• • Target

    f228af74ecf7302bb5e8d9ce8060a9aa3fc2bd583bd477e23543452cf1cebad6.exe

  • Size

    584KB

  • MD5

    45209596ce41c4359e9006a940042763

  • SHA1

    8559b5a187ee146a869301e5c0fb23a5c4510772

  • SHA256

    f228af74ecf7302bb5e8d9ce8060a9aa3fc2bd583bd477e23543452cf1cebad6

  • SHA512

    16828ed08e983b6fc1fce972ccfcea10dd0dccbf67602557b7071802d0f01e4754a63284ea05a9798cf7c8784d663ddc9d51fd601fe6f7b4407714b6bc3b1c39

  • SSDEEP

    12288:VndZauZt06GQyWgYOsmLzFcWMphB2/VawLTl761wXK7WqpyK:5dZauZtP1VOsmLJcWMphQrHg870yK

  Score

  10^/10

  formbookgy15discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2