Extracted

• • Target

    5c7908f7626c74e9233895e903b7de4a.exe

  • Size

    660KB

  • MD5

    5c7908f7626c74e9233895e903b7de4a

  • SHA1

    91275d7d5ba3a296323bb6fb963a8aa798808eda

  • SHA256

    6f3d1b553efdcf03ca4575b2c6afa39cd845bb306adcd6e876864321e7e74a5b

  • SHA512

    90af34c75533f74e0a81880e00ed5fae69ce1cc650bb54c35d244c38dd3b6e3db62b8a752cc81a681898a04771dbbde0116b346f3c6bbb6c26253187105ef55f

  • SSDEEP

    12288:vnYRxA4Y5lyA/BxSPCmPX50CO5jlvHLULZlxqaaA6b4e9O5fYYD6/IhU3A5JU3IY:QR5v565jJrUPxBb9h5QYDMIhSmAZJ

  Score

  10^/10

  formbookkmgediscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2