Extracted

• • Target

    210c8c40bffff97e6fc7fc670e3a08d67c55307ec73295eff3d2c8b88983a02f

  • Size

    681KB

  • MD5

    f3c65d21c85f13bd02bd9ccde0fe7204

  • SHA1

    f6cccacd078dc1ba74271fe901b6755fe6bbc3a0

  • SHA256

    210c8c40bffff97e6fc7fc670e3a08d67c55307ec73295eff3d2c8b88983a02f

  • SHA512

    8e496e7c853f247e48e4f9fac912c9a2738a178d201cbbe4340464fa84be7801d6b7cd6172f6c1fc47db6b1e134ea1cb9742f3b92e80846b069986e74845dea3

  • SSDEEP

    12288:JYSGuxswecl9UWCUnRAD4vksa3nnZSNz/MZ9b8qEE71el9EihGj3NykXnxzA:UwegCUGD4csUZYz0Z9dh5icj34ux

  Score

  10^/10

  formbookkmgediscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2