Extracted

• • Target

    bcfeb4ec31e731899a0ddd0a608aa7ecbfbdbf37f4ac3810b275ba6905a1969b.exe

  • Size

    836KB

  • MD5

    735a274389af85c4b4f6ccd684b1b30a

  • SHA1

    2ae6619febb0c9f4d318daa9f28172c2ed9ed4da

  • SHA256

    bcfeb4ec31e731899a0ddd0a608aa7ecbfbdbf37f4ac3810b275ba6905a1969b

  • SHA512

    959bd09b752128ae08262bc7803b857099e3727f025f380a918f5b46ac64384180224ef40cc086c795f54dbb8621798b3ba95362805bccbc634800fc626bf14a

  • SSDEEP

    24576:C8yNK1t4NK1tOqLB94uH/Stkd3uRStXvfFQ:Rhz9fvj

  Score

  10^/10

  formbooka03ddiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2