Extracted

• • Target

    bb57e60238a1f7954433764a77c251f0b6367120592605b04307bf2d3aec446e

  • Size

    623KB

  • MD5

    d796106a6798936495f83e5eeb341c90

  • SHA1

    671a5437ce4fe56510909a852916a19eaf983dc6

  • SHA256

    bb57e60238a1f7954433764a77c251f0b6367120592605b04307bf2d3aec446e

  • SHA512

    9cbb995f2d32fef68348d0037ea8b6fac98ba86905b96658bf527961ae04f63ce65a23efcb4dee6e6fe8b3f1e5cf77e40221fd92dff925e0a60c2563eac2a7f7

  • SSDEEP

    12288:no8bkVHKTBePSVM+q175iDNDGgYRtUkBpRcRm9SGiJ4if1kC5Lf0Lx06+r/R4sM:no9tKTBZZE75oNyZpRT7oTOe4C6+r/R/

  Score

  10^/10

  formbookjr04discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2