Extracted

• • Target

    uALWGsOK8vuuevn.exe

  • Size

    1.0MB

  • MD5

    d76584afeaeb9111b312ca870ea94f52

  • SHA1

    a428a457514fc6ad0426e983d646b554050e8176

  • SHA256

    273481ccb3fe3c8f7d756a02fb9ddfcdf36a7e8a65abdc3dc66abf7546e701ef

  • SHA512

    1166b92986d093f0a2ac189bb09c1ceec63bd229a18044c4d196b711e21e159fd178cf170db72d510e45ca2da5fdd7ffb854ba76a0d13d7790b6ba1329403ca4

  • SSDEEP

    24576:iH8WY71q/qeY38csNmg8pGPYlv89bEzj/AT1qy21:0a1qUMLNwpl89ybGs

  Score

  10^/10

  formbookcsn6discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2