Extracted

• • Target

    ece49e828c96a3cbc96535f04ef66109c997cb13a87850c4b66b3de0fd2818f7.exe

  • Size

    722KB

  • MD5

    07055b5c25983542e28e73e03e4e9e59

  • SHA1

    ada64e9c68e8d508fefb1ccb57273b28aa23814b

  • SHA256

    ece49e828c96a3cbc96535f04ef66109c997cb13a87850c4b66b3de0fd2818f7

  • SHA512

    6ce52ac945cea8e396e30838b77a06c20fb6b739dd4bafd9dd8f88ad37dee52f54035d5088f67be71eea46adda2a3c5e92929392f2ff93fb0bbe202f1105e06d

  • SSDEEP

    12288:045J6WhRSUunBIag+tpYXfkv7I3OqJ+lAaHp1MnEHqpSb/gH+pt5oxWv:d6NnBo+vYvk7qJ5BEKsDo+Zoxm

  Score

  10^/10

  formbookbc01discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2