Extracted

• • Target

    ebb5ff83ff02d5cc378fdcb1730736e22535ea3b945df2f80c992fdf09d21344.exe

  • Size

    557KB

  • MD5

    4919265b7099fa0f8f58df4e824c1b21

  • SHA1

    066783dc80338a74e0b1f8de272eef02a6e04391

  • SHA256

    ebb5ff83ff02d5cc378fdcb1730736e22535ea3b945df2f80c992fdf09d21344

  • SHA512

    24b4546f78849c9489deac6cf496a1b2ead5800599d0a5c3fefbe7835d7a44374c693ade7ef0f375d9f9cc6ee3d6dd14aacc628ac4d356ab443a25070da083ac

  • SSDEEP

    12288:7bUSAWFHil5oqaWB1meO4pT7eTAqLySHqiO/B/rbKbp/zF8PnEh2vo1:7bAkCEqaW/mZkT7gAMKL/6p/GEum

  Score

  10^/10

  formbookt18ndiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2