Extracted

• • Target

    bcc41988bc560c5ddf3e58165cc25daec67e3a33529b2179868f1b4b7746db7a.exe

  • Size

    743KB

  • MD5

    96e86e405d7562e778fa380a07ff8ff7

  • SHA1

    c5f9c54d9bc639e7f84447e8d0b79323ef128b02

  • SHA256

    bcc41988bc560c5ddf3e58165cc25daec67e3a33529b2179868f1b4b7746db7a

  • SHA512

    ae7ad2150f8c9b0037372af0092570d9557cbff7e6a5b260407211410c4457b105416a10a2c30b8ceeccf90ab6cf5e5970b1c53a5861af90e859c8924c1a8c51

  • SSDEEP

    12288:uU8f2uE1zDMjwPCBchAASH2gDkPN0IJzI/4yoKAaKKiq08f2:uUu2uOUjw2chAAXgYmIJzI/4yoKAL60Z

  Score

  10^/10

  formbookk49sdiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2