Extracted

• • Target

    NGACIVADAIR25002.exe

  • Size

    931KB

  • MD5

    17b3c938fbf0a3f652288ad1128385a7

  • SHA1

    8818efc1a67778d016396db9aac4a23a30e2c1b9

  • SHA256

    8e06ed422edfc7904592e8c8cdacebd0ad5118c4b3dcb3daa404e8e4d97f6e5a

  • SHA512

    9763f8865a0a334c960b42a05c6157f844bb29b23a4fd0a042b385e7360fc22e9b5602806a20933d5e4442aef0dc30fa16a98eb920d97f4678fa0b7d7456ec4a

  • SSDEEP

    24576:OyjdTYjz6FxM8JGjHlhYN52IYpOG9s+3NI+pxNaCkTZnc:nTOz6FqlHeB4s0kCkTBc

  Score

  10^/10

  formbookb02adiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2