Extracted

• • Target

    2b73e14598fa9527a5d3b18e34a2b263a4001785a862932005caad64025c86a3

  • Size

    669KB

  • MD5

    ad90b7ef4c9611dc1ba60fccef729b3a

  • SHA1

    5e6f73d1e88a5e7ed7283ba195ed158849ae9cad

  • SHA256

    bf6ce08a4c3bb3395310e980d52c5cddfd7d30924e2c1b1b1451790421ac6d6e

  • SHA512

    900ff1695d83e832a9f6d0d7b5f1f0d2240bc0c8da0d570494d79f9506de794bee67dcf40ed9b20e112f295e03251c2c06df62d9bfdc9cb99200cfa586699b1b

  • SSDEEP

    12288:dKjNZYuhezUIseO40B8Tn8TRPyca/AxfuWVd/KFBSNUehNLn:+1HVNWTnoGYwWeFBSNUeDLn

  Score

  10^/10

  formbookkmgediscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2