Extracted

• • Target

    22a0ce1fbf304b11510e89f1db8124bf84c59049c919c7b6bbce222db99bf014.exe

  • Size

    915KB

  • MD5

    043bdeffd5a49926947bb5da9ffafd2b

  • SHA1

    962ea1a4c285d1788b01b82ecada92029562c107

  • SHA256

    22a0ce1fbf304b11510e89f1db8124bf84c59049c919c7b6bbce222db99bf014

  • SHA512

    d3769e2042754b32c9b7df1e6bf313f9bb59a4489f65e87720e21a97a84b246202af6f989a00490f6bf348f67d4ec65732e3d922909cf45381ffb582922c2638

  • SSDEEP

    12288:cgSKO12iNPwrP4QZd335766Hav0LAxij1Zk3YJQRu6BqxVdaueP/7B5XH:cga11hwrP4Kd33Ax0RmYJX6UjXePTrX

  Score

  10^/10

  formbookt36tdiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2