Extracted

• • Target

    264363a6ad5f6720663cd201f8037f0c6f3bfda8216bb8f975e7df9fd9c699b9.exe

  • Size

    756KB

  • MD5

    147579a97da0eca0d7710189aa127157

  • SHA1

    fe11ac8a0ddb01d39a5d2614686738d9c9e8a9ff

  • SHA256

    264363a6ad5f6720663cd201f8037f0c6f3bfda8216bb8f975e7df9fd9c699b9

  • SHA512

    6fd90440b24d239c88ff8264f99b4c434a14b4e1d311579f42d6a0d681acc5e1d00ce593521a68efb168ef6ed7bcb71501a0e1afa6e5bceac4c5107de0d1ef1f

  • SSDEEP

    12288:dlMQIaLR0bwS1+ccfxuwdjXtm4DIpeIQt1Ct9qmLwy9EXX++S:NvV18xApjXtm0IpeICCt9VLwFO

  Score

  10^/10

  formbookct27discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2