Extracted

• • Target

    ??????.exe

  • Size

    1.1MB

  • MD5

    e5d39dbcb30238929cf0ace419b207e8

  • SHA1

    f5c499e26a082a97ab0c4f2fb8dba82f719a37be

  • SHA256

    a27690306574d230791d1625c7657c8460a1ad5a3bc0187e28a7620f30da14fa

  • SHA512

    52d1bff13ff64c514fd804887e034809023d23abf77ebf5b8aa04a12b4c6575f348925f76a82bc793167307e9775400eee2aedf5cf0e1b11b932da17bc4e89a3

  • SSDEEP

    24576:+by9e8ItJePeyuFyVU7/78m9w9BxanVR5VVuj+olvm:+aOtJePe/Fyuf19w9BxIT5VVu+olO

  Score

  10^/10

  formbookgn27discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2