Extracted

• • Target

    c82b82cf444e4a02ffe7091ef5ea7bea733c2127c38366c88775cade7d234681.exe

  • Size

    619KB

  • MD5

    1be8f540ee2f46e7a785c8b270766eac

  • SHA1

    981fc167332b9d199a411d6b6af08a45005fd1ec

  • SHA256

    c82b82cf444e4a02ffe7091ef5ea7bea733c2127c38366c88775cade7d234681

  • SHA512

    2284048bfb50db7e092445fb7cfcabc09ef2e92d51f992ad5229edae897d374ff5c78cb78df0be77551aafa5a327272cf6aa89d3144be699f5008b056a41c7cf

  • SSDEEP

    12288:QQ0LIWqps7wnzTEnkd7fBA/HStVvBTVfhcm3tAcAuMiekrS:QrF0ty8fBsHSzzJvxPG

  Score

  10^/10

  formbookcu29discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2