Extracted

• • Target

    a7fc129cd3069c3c862c28990c131e3dae5fff42c5ab8cb034e8e8ea12bec94e.exe

  • Size

    883KB

  • MD5

    5761dcb8640793699cd177a59cf2c0ed

  • SHA1

    81ca3ccc56eae9b91b31ebe9f791e03226710204

  • SHA256

    a7fc129cd3069c3c862c28990c131e3dae5fff42c5ab8cb034e8e8ea12bec94e

  • SHA512

    a9c8020e098fac8e6bdab0ef0c09e42125e4c56b3b37c76ec7ba978c46620af95394b3f608482cc6ee9683d54457a095e0054902bd9d11cff368b64cc6bb6ff4

  • SSDEEP

    12288:TLzUMXe5y/t1uKxREmoYctVxrTGVOuO8YSK2mxR6iL8S4tcJpDoRwe8QVDFzQhJ:TLlx8YmrCd/PZmxR6iLJxpER9VJQ

  Score

  10^/10

  formbooka01ddiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2