Extracted

• • Target

    9109456918e7833784c58988098f87eb007e4038f516241972d4cc2450f43df3.exe

  • Size

    833KB

  • MD5

    a6c41278ad08a6dc829a7f411fe47193

  • SHA1

    10aebd0e7a6da6c6fe10b37a6b171d801b8b6924

  • SHA256

    9109456918e7833784c58988098f87eb007e4038f516241972d4cc2450f43df3

  • SHA512

    e2ca3ed8565c38cf472f1258bee03d1d1491ca315ea95c86a4af53754e198428d1caf908f3ba70dc39b6799e1d556e9500b248dd40c9f06bccc22da32d776a27

  • SSDEEP

    24576:I8yNK1t4NK1tOqLBJ8IEFBlB5roINZQQ1yer:XhjYPlTomZ

  Score

  10^/10

  formbookg10ydiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2