Extracted

• • Target

    1e6bdda859cf7324cbbb98eba3f817db4cc00f8495b93cbdd46adb64be1b3c01

  • Size

    807KB

  • MD5

    178a7a9746f4671d810b5f451870f4e0

  • SHA1

    980c97f058d1248411d9ebc17383ab031fa4e1e6

  • SHA256

    1e6bdda859cf7324cbbb98eba3f817db4cc00f8495b93cbdd46adb64be1b3c01

  • SHA512

    373e0e4b9760c36c84e182d68d10c5757d6b7d9d572eb3adda8acd0bffaded5df495097805827b4e21a19fd31c458a46e02184f8b31ba5f7dd564fc2104f9f1a

  • SSDEEP

    12288:hsZP7BAr0ik1U11R/5PG6nlY6lJf45rmtVSShhzgD9VwF/302CrQW:XkSPTPTNvI92x0

  Score

  10^/10

  formbookmzk6discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2