Extracted

• • Target

    8389b3ecce08249b5d4ad5eede18ef1136f4acef3137fcd9fd4850082e090049

  • Size

    661KB

  • MD5

    4b1b3a715305efece2e7c37c5346a719

  • SHA1

    d4b0fd026b293bc0131706a49d73db072b0b136c

  • SHA256

    8389b3ecce08249b5d4ad5eede18ef1136f4acef3137fcd9fd4850082e090049

  • SHA512

    18c3eb1dc929b4c7143b2f6b9327b78e6c3cfbbff87216cabbe23de32985e694ba1bcdc5ae737e69472147a4d8d6475fdcd24ffdf4ad1357fef97fb5147335d7

  • SSDEEP

    12288:M6YRxA4Y5lyA/BxSPCNiITWBlyZWuActY/V/5E0bblR+1Y7NyEFcePZCR:URo7Sy4uActY/VFT+EyMZCR

  Score

  10^/10

  formbook3nopdiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2