Extracted

• • Target

    Doc_ 1220625.exe

  • Size

    738KB

  • MD5

    27207e6788f168b5c7fc25cf4715004d

  • SHA1

    98765371928f698680be85d1ccd11ce4ae6b095d

  • SHA256

    e4522a65f679efbfcf6604c6d3636c62d8d5ccd8fb413d0f446583804424fd77

  • SHA512

    05b9abf864c431bc554e930a12c90a2729fba13a25f562b0f24c959f95d9383ef0d924a43fe38b39d4124341f98fbf33d1b27e8ad9f2e6add94f7a34b2941c53

  • SSDEEP

    12288:rRWyvCiBZ4JwtNXNmuPQdotbKQxzpyCi9mOocITX2dN1IGdqCYA8B6slRIp:1WyvDZ4JwtjZPk4mC1oKcITXC7dqCYkr

  Score

  10^/10

  formbookbc01discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2