Extracted

• • Target

    dGMCIcKTcIsMgWV.exe

  • Size

    865KB

  • MD5

    a5044479b5b01e3f1e673ac9f46f1260

  • SHA1

    712b4374d8f14f6bffc1f57ec59e9755c8926ff7

  • SHA256

    2b9b9f253f0c34fc745803cdeef66e7930be3dd10e37c4e1ee76e5ed311cd9f1

  • SHA512

    ef85958594ce5b59db1670aa8f1753dd913f417dd2dc1954e85f1d8fec1a928a724039b0897df4c69f9f8bafa6f6ee8028d5dfd1921d6e65d5857e9a9c5ca67e

  • SSDEEP

    12288:GtxoRVY7Oen9f9upsZEFKV7tY4axOtzDftua4V5iQd:oYVYqmPLZVuTIH8a4V5N

  Score

  10^/10

  formbookt39hdiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2