Extracted

• • Target

    T?cili Sifari?.exe

  • Size

    1.0MB

  • MD5

    102a540303ec7665687ee20c6a6f3829

  • SHA1

    dc5b7f0a3a72215e0fb574ffae9dc1ca80d8394f

  • SHA256

    77de2fa49e24c93e217088285cfcc816cf7ae40928898dc3e88c0d6a67a31c80

  • SHA512

    887c9e35701b2a8d53a5973f423b10f6c4312d112fa77ee64453f43a451b5f34449f4e0cb7c5974efc73a3621ad1fdd43f7b88ec34834c6bced162364cd6a5b2

  • SSDEEP

    24576:4Vr94W+fAEY/PyVvoieXaM0GGbr2lmmY0tVe68euC/:4VR4DfAlGoibM0G8tmls680

  Score

  10^/10

  formbookd2g7discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2