Extracted

• • Target

    0202-22.exe

  • Size

    462KB

  • MD5

    25187246817de52ff581a45f4f11f241

  • SHA1

    6166539dd8e4848758432de290c82cdfa113d0f7

  • SHA256

    f5d980b064f019eae241837745f27d679386904a95caef0e572709611019cc7c

  • SHA512

    797350c31c78d5df0aa24b12c7559f380253e64f03b0b629501d2cd8abd8b8174b6937816315b17cab1a33a858c652e418f5ddfb0475fd37f364dfe46ca27115

  • SSDEEP

    12288:CVO7JCi3zD56YS6Hu8IDa2yMxTsZhkeM4:CVOVTDD5pHuK2txTsZRM

  Score

  10^/10

  formbookoh75discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2