Extracted

• • Target

    ТӨЛЕМ ДӘЛЕЛДІ.exe

  • Size

    1.0MB

  • MD5

    ca855d522883a77e22f3c512c74540cf

  • SHA1

    4dccebbf55ed8db1b5c343fe632cc857ff18c312

  • SHA256

    61a82b8dc50c7afd24dae16dbb34d0e03dcc46ad5c6ee66545ce49f30a25aa2d

  • SHA512

    670cd34b43c18ee4237b35e3dda05aaf46f79c9bb8431fb2195153a5772521a7b8351a948c6d0c9b63d6a99636ca9eea64606f4c118f8dce462a0116e824542f

  • SSDEEP

    12288:SJf32iNHK4HTNNs+00yMSVhoHkumou4WhGW5Rhz9YOsHCp6Dg6XZdnNYEbS8DJN:SJf31bty3Vj/phGe3z9YOsHCWL3D

  Score

  10^/10

  formbookgs25discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2