Extracted

• • Target

    83e5cd1ba8c1485400c9faa0295df97768515bb2161114790dd6a3d8cbb05c4a.exe

  • Size

    754KB

  • MD5

    606e6075bf7e419fc19c36e467b600a6

  • SHA1

    91ab445e375df3853d963662e7b6134616e94dd0

  • SHA256

    83e5cd1ba8c1485400c9faa0295df97768515bb2161114790dd6a3d8cbb05c4a

  • SHA512

    e10e3ef6e14ee29bccc695201efd98d6ac498c3ee718b4ba8834de70ab5324b078ff0f2a4efab9f3ecf9474da6b33ec9c0ed52e08a331b719f659eac38892cf0

  • SSDEEP

    12288:xEoPN92Tuf/sv98Vx4PlsfMXuLjej1YhZ0DfMSgMmE:+oPN9eE/sv98VxGsfMCehYhCTMS8E

  Score

  10^/10

  formbookbc01discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2