Extracted

• • Target

    TKq18zZ3Rtcbhfd.exe

  • Size

    690KB

  • MD5

    40a0efae53cd30740fd47e5f79a46eae

  • SHA1

    2ea4625d31a8c4fa8e6c9b3bc4abecc6341fe788

  • SHA256

    58dfe85f084bedbc1861ed4afada8f0e284a70e10c84065cc6df13adc9fb45db

  • SHA512

    0caabef7ce39f1d2fb4f21c7cf8f59da389babc1f590910ea85c8b5a4d28e40a572802ffdf55eef95d4c41999150a777b55825056b3b8d7bf744cb567fbee1e0

  • SSDEEP

    12288:Qiv1uq3JfXyN9u9A0NAUFE/P37NfmAl12tZ9uLUxL7HNHJTs/m:RNuqfC/unmUQ7NpqLB

  Score

  10^/10

  formbooka02ddiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2