Extracted

• • Target

    36b2c227683d3aea101fb59edb33edb1ba28ec0753a32a5ce42b1959d6716965.exe

  • Size

    817KB

  • MD5

    1edee1c73023c587df17c0809109e1e3

  • SHA1

    d159ab5348cd9df33877f91190057abaff01dee8

  • SHA256

    36b2c227683d3aea101fb59edb33edb1ba28ec0753a32a5ce42b1959d6716965

  • SHA512

    aabcf10c21a336861eb2cb69c545ae6a70ed73d23fd5a7af74a8ededca7eba01b80395a375465bc1ca1c2286c54b68fb2af74336b324fb3f1113d6da57927740

  • SSDEEP

    24576:IzZx2I6l5CiXV0eFxiuUcWpkBW3KieLn:o2IclXSeFvF7BwzeLn

  Score

  10^/10

  formbook3nopdiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2