Extracted

• • Target
    8ed60c6c3516465b2918af6a467e3b38c3b64fa39a32ee79d1337b15e1c3ac0d.exe
  • Size 571KB
  • SHA256 8ed60c6c3516465b2918af6a467e3b38c3b64fa39a32ee79d1337b15e1c3ac0d
  • MD5 0f5b3d7f248e0d6f9f41e81c34b36931
  • SHA1 d6dcbd8049618c92c56aa6c3941409a3fa54c043
  • SHA512 ec1e0b32dab608f150f081cb2df749432b61946d31f5da4d30a4ef8d9414c6d342c590891dec4a1b5836f888de1845f8d6c09ab3ba720ca992beedc11c713615
  • SSDEEP 12288:oIUSptbFY09TYHMScaCKKTKFo8YntlLe3DKxlTAH16/kR:omp8yS+aCrTKFvYt4exlTC
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookp25odiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2