Extracted

• • Target

    4d49933551f01cc730f63fd290ecb61f4bfa880a0660f0ec7363e148ef85645a.exe

  • Size

    647KB

  • MD5

    d9d98d244f3d4779c8aa532562ffb536

  • SHA1

    594abbcf69862f343c0ce75716da5607ab6bbaed

  • SHA256

    4d49933551f01cc730f63fd290ecb61f4bfa880a0660f0ec7363e148ef85645a

  • SHA512

    4807098ae5e3db0b40e32c7cc053580202922cc3cc1374aacfa5d767e3ca2d94255d029865a6351233b613835d06068011a0ea15acad620256137c8ed826ce96

  • SSDEEP

    12288:+YRxA4Y5lyA/BxSPCgPGT5GrNz72lYBjonsMqfGx7OnOSSGsR8CleigAVJTsxZtK:ZROUrF8K0qq0OEfCQjUszE

  Score

  10^/10

  formbooka03ddiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2