Extracted

• • Target

    64a8f5c2209bf86e1aa4489fffa5cf93aee6955b0106909345a313de38ad7885.exe

  • Size

    712KB

  • MD5

    6cfdfa1de0f031646ee75bde799cb877

  • SHA1

    6da4c76342858daf1c4e55d537ebfe8b846b87b1

  • SHA256

    64a8f5c2209bf86e1aa4489fffa5cf93aee6955b0106909345a313de38ad7885

  • SHA512

    77acb0a4e390c687d5e4c70c9c4b2f4c6b3e01cd53faf61e3d3e760f126c843ec3a51321d5110796891d0409c3eddbae6cf8653e31c19a77d3f411914ccce72d

  • SSDEEP

    12288:nX5Xt1wWT9YeNqKXO0WTmPUIBdL23sUk/d6nifUmyyDdU/wxSc1GFVeDB:hT9YKXO0fbf16nicsWoxS

  Score

  10^/10

  formbookbc01discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2