Extracted

• • Target
    890983726372673.exe
  • Size 722KB
  • SHA256 2040a0fdd0eddf11176cddce8489b0906e9bb6ed39b2c825f883e26a3309db57
  • MD5 0c883414fcda149f14bfe37c2bd9fc79
  • SHA1 cf99ca86cfac68a7414ce261bdbc04263de1ee77
  • SHA512 2cdce3e4094cd4c72d3f4618fdcbaac2548bbddb4b4471d7f3838817913574a8b63b890be5a1ed8ce0a244fe24114d6cc25004dcd6be8ae62c0703b7e1815067
  • SSDEEP 12288:ZSihRSUunB2fP+rnhBR44lSQ5XUIT7sLzm1BHS/YlJ/GOX89rUU0+KlQlNLn:0xnumz1UITez4BlR7XQ59KaHLn
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbook3nopdiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2