Extracted

• • Target

    afa20273425a5657b4e2d93938d497efea89a8a1ea35bcd590e52d5225f99857.exe

  • Size

    707KB

  • MD5

    63315d4b2f33eebdc4b2ef5e139c02b3

  • SHA1

    ea275731bf03093e1b5364129d365fb908b2802d

  • SHA256

    afa20273425a5657b4e2d93938d497efea89a8a1ea35bcd590e52d5225f99857

  • SHA512

    9033a23e9d2042bb66b679e9c39933fb563847f133f85717d7cbc8bf1610c2720287fbe50d38de53046e73184cf90572d6be8f890322e8888670a47f5e8d1c86

  • SSDEEP

    12288:TF0dkI8Xp4gnV2v8gWfRhkMpCof0xrQ53Ms8a+U/gSaE55BO3Uug1o474q7Z:TudexQ8PfLJRf0FQ53S1NSHjzuU+w

  Score

  10^/10

  formbooka01ddiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2