Extracted

• • Target

    10b78bea9f7acc71be5868fb39e4941c06ec08c4b0ea25b0957ec6b63fe37e20.exe

  • Size

    835KB

  • MD5

    ff5640b9478170f504c7a344f2cfd2f0

  • SHA1

    3ada7fc9fd12140209115cda646b3ecb1a8c8ec4

  • SHA256

    10b78bea9f7acc71be5868fb39e4941c06ec08c4b0ea25b0957ec6b63fe37e20

  • SHA512

    db9e03be02bb52112cef4622bfe2d134b87f9e66227501d50326138aab17fcaf7aef91950e4131b3fdaa7d1b960fafc5284a181ef53351ae7d377502ffc7f6b8

  • SSDEEP

    12288:fEUM8HCoR6k/LbPWJxKXuNMe7IiSR61+7iRTKJq5:MUMRCNLbOSX67IiU61+7In

  Score

  10^/10

  formbookb02adiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2