Extracted

• • Target

    205e98d299b32e102e3d6fadb9659f713601f8f713be02cec1ec0f437d3be075.exe

  • Size

    802KB

  • MD5

    9a7cb2884499e277aef3285bb7ac621a

  • SHA1

    61a63562d75ccb13478aee39dc80395329357d7a

  • SHA256

    205e98d299b32e102e3d6fadb9659f713601f8f713be02cec1ec0f437d3be075

  • SHA512

    15e6e63a8fd1764dca53a34fbd6fa9ac99849ca43d34327741f87c9f80a931cfdd71c7c993e6764e16c34f9a60ec5edabe745fd646339601eebbf783a7fd967b

  • SSDEEP

    12288:WzSggsiqyjHBCYiOKE5uz0nL4EJhyJvgOE4qYCvI7:Wz1KuT8L4QIJvJE9YCvI

  Score

  10^/10

  formbooka03ddiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2