Extracted

• • Target
    8e000211c865431b51b1e3733e0bc6d7efcfb8a3d45631cb10f0d7813b0b2e59.exe
  • Size 883KB
  • SHA256 8e000211c865431b51b1e3733e0bc6d7efcfb8a3d45631cb10f0d7813b0b2e59
  • MD5 4a8a2d322d92d6735f84bab448b7ded7
  • SHA1 e2b23500b0ce74322e97db84668a6b7c2e4d2be7
  • SHA512 c42ba48b679c87247c5378016aa37454383f72e60a148ee05b53c5bf85dc13610f5deebe830724c49f83d696f3385979ad682861b9d3fc5a5288dffcc5e33536
  • SSDEEP 12288:w1ndbjFtPL0q7CZg3utoAy8wvqN6KQ5mnZiTRmvQYd9oRyEtsc4BQgTEsVQGf3Ju:no/sELYL+ktE5GxDmd
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookoi08discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2