Extracted

• • Target
    4FaxVAj4tnLxTFs.exe
  • Size 678KB
  • SHA256 2dbc649f56dbbc3bc0b958929fd993b6a0dc60513c9cf95c9e577bc71534031c
  • MD5 d9a073ae613c2d5ce0e8baf11ab4be36
  • SHA1 5ba2b95efe8c8bc83f2869a95040ebdd087f9aaa
  • SHA512 72545d2a045e23a7fe749e4f18b94fbdd080a936b0b25fd028d9fd5fc3bd1e144bbaf004589038527877242eb76c21fd67bb377983503db5d6f10eb07561ca08
  • SSDEEP 12288:oLtTMpm+gvyxSQoE28fH+b2Lrpr9xTFdU+fDpVUNUGc6xZidXjSSs:+tTL004XxT7LfDpVSUlGsJ2
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookmy18discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2