Extracted

• • Target

    bb1aec54bef16432b3a9e9a35cda7dfabf6e20218384adcc05d685f5fb064a4f.exe

  • Size

    685KB

  • MD5

    120b40f5660509f801c91710f54c0310

  • SHA1

    9796b9bc392d3a16548e5e44948cdb7dca74f2b6

  • SHA256

    bb1aec54bef16432b3a9e9a35cda7dfabf6e20218384adcc05d685f5fb064a4f

  • SHA512

    85792741bdf335a2a2bd7bcab3bf7b79555df316161261b57294662280e022e689f73c34f433a700d6cff46094074afea618500dfa4e62cf9a9ba102c5dbf967

  • SSDEEP

    12288:F/dnNl61az3aYgC4t/zuuZN9xLyAi16MuEFqeJ3QAyySJU7hV4R0/NpZiW:ldnNscaYp4tCuZN9VtzEF7gAyyK30/N

  Score

  10^/10

  formbooka01ddiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2