Extracted

• • Target

    59b61cae949f25e521294989968bef92ec65ec67022bfd11179c5ff1daea4d5f.exe

  • Size

    632KB

  • MD5

    8608c1a35800f1b1d6c49401800fd3ea

  • SHA1

    e953f684bb1202b467984ad17c988c612b6aa37f

  • SHA256

    59b61cae949f25e521294989968bef92ec65ec67022bfd11179c5ff1daea4d5f

  • SHA512

    94f04e7a2a368b1a0dd4b0ca23ca956b258585db77294b246025ffc67ecbe1ddad420fb2bb1eaf3322102f826a07c3a3d89332a3aae4bea78461fceab9f3c7c6

  • SSDEEP

    12288:5nCvtqevGPoF8ZzJiL8ZUtdOisOMM9CVwyiz9K5+4uTmZUJmEj:MtVPUJigudOsyFw40kUUE

  Score

  10^/10

  formbookt18ndiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2