Extracted

• • Target

    9d81ffafe26b6cf9e8c5fb0ff739c279d07c6d96b7f1f3927741e7cb6746b452.exe

  • Size

    946KB

  • MD5

    e22800de8e660dac81009fc0c4d50c35

  • SHA1

    9eed1a0611e174ce577123da232f4b148bb6d7d0

  • SHA256

    9d81ffafe26b6cf9e8c5fb0ff739c279d07c6d96b7f1f3927741e7cb6746b452

  • SHA512

    2d5b5ee82fb896e23b2f333c3bc3ba44143309fd20efaba324ce895841cd4fd211cf0828de706d62363d49fb4f64312f3e35ae631fdbd2fbfafeed2e6ce01283

  • SSDEEP

    24576:PoWNH51zNhom3/sCVMscleAaIT8Bsunzs8T8T/vzLn:PoWNYeTVMRaI2sunzuTvzLn

  Score

  10^/10

  formbook3nopdiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2