Extracted

• • Target

    8ed60c6c3516465b2918af6a467e3b38c3b64fa39a32ee79d1337b15e1c3ac0d.exe

  • Size

    571KB

  • MD5

    0f5b3d7f248e0d6f9f41e81c34b36931

  • SHA1

    d6dcbd8049618c92c56aa6c3941409a3fa54c043

  • SHA256

    8ed60c6c3516465b2918af6a467e3b38c3b64fa39a32ee79d1337b15e1c3ac0d

  • SHA512

    ec1e0b32dab608f150f081cb2df749432b61946d31f5da4d30a4ef8d9414c6d342c590891dec4a1b5836f888de1845f8d6c09ab3ba720ca992beedc11c713615

  • SSDEEP

    12288:oIUSptbFY09TYHMScaCKKTKFo8YntlLe3DKxlTAH16/kR:omp8yS+aCrTKFvYt4exlTC

  Score

  10^/10

  formbookp25odiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2