Extracted

• • Target

    Barisan baharu 1.exe

  • Size

    669KB

  • MD5

    c52ea876f58edb9e098c468246cb3c45

  • SHA1

    321ea4228f13cf39458031650a113b8304728b24

  • SHA256

    f5111a8cb2ad774437f4c7e49e57f936188943f9819741754ae3ccc5fe02fc50

  • SHA512

    473ebb28bd20be55942cbc07782391a6077532188f41c19d0dc1b3ac4bcce4c7f54ce5f1a88acdb23157ca8fb3ec1fa28a75f174bc6d1cf5ad0bc7903b0cdc9d

  • SSDEEP

    12288:fpMgHlCsDN+a1BTGSzFFZ6hCH3xGPAs1f+6YDl6BZCLJGvT6cOwRhk8lPVR6/LkC:fpM+U6cOwRPlPm2COaECPU5

  Score

  10^/10

  formbooko27adiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2