Extracted

• • Target

    6.exe

  • Size

    762KB

  • MD5

    8389dab9dc0d6595ea72c3550da3e1da

  • SHA1

    51ca86545033133ac0b64cae05b28d5f3c2d6d8e

  • SHA256

    95d75622d314e27cd7ff796245897f4a68787a166d5dec0b2464d820e526492d

  • SHA512

    14b4c337e2381fbc34ecf59a073fc6d49934008a54d1c46075d7cd669734c5bf958ba15df444a7b5898dd559ed7a13fa4100254ca0daaf478cd50ac650311be0

  • SSDEEP

    12288:uYgMIO8DfDrRrA0qzOq1+ceatVXmFvFMmRdLvn+H9srzlozkZIad:uYgnfvRkXBx2s9srz4UIad

  Score

  10^/10

  formbookbc01discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2