Extracted

• • Target

    5227918355b47bf8f0cf6eabb0628ff59339d6fd6a3a56ceca4dcefd06dd8d00.exe

  • Size

    519KB

  • MD5

    ac506b9b66dfac14f67ca92c679d85bd

  • SHA1

    bb39da67bac5c77002c3d88e80888786fcd83acd

  • SHA256

    5227918355b47bf8f0cf6eabb0628ff59339d6fd6a3a56ceca4dcefd06dd8d00

  • SHA512

    0a92d007ae6331fd4b9fc8f037b9581fb051ba63fefe0b8f1f74f799885875597b53a579e0c6e7273e336b7de3197c3d4ca92ddce3c45bddde25ebb529464834

  • SSDEEP

    12288:yybs6xoSoNgO7lTPf5aJgGkwuV49WXnX8kp07kyLL1XXMQ+/8+:FNxY3aNkwuV4OqoyLJnMi

  Score

  10^/10

  formbookcfvcdiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2