Extracted

• • Target

    ypBNBVznebkl.exe

  • Size

    590KB

  • MD5

    ca8fd7f239f0b32c15261766b4134de0

  • SHA1

    7902a3d808b13b7bbb16cf6a711b5c12abf735b2

  • SHA256

    17299141dd71b72d2aa0250a478b4d3295ecd09b575232463ecf592cadda19b5

  • SHA512

    0982ccce0d0dadf9573f15db9fa861695eacfd9b05741fe3698f2ecf4c46d9133545228718f631bd6d2c2a3025199ccda08cf28b33a047b2ad34e9220c2d71c1

  • SSDEEP

    12288:/qY0mthJLGhLbg4B+ePduGIERcwr+t96CHwNnLu/2J:S4hJLGdg3GZNGt96CQlLjJ

  Score

  10^/10

  formbookg2m3discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2