Extracted

• • Target
    FbL6HMA75LatWGE.exe
  • Size 666KB
  • SHA256 6f8e85f3704f0179d0854b1c278784441b0e555f6cbbd7af19a677afaefef004
  • MD5 5c1022d908beaff7f12da5e9fa8f2f18
  • SHA1 52c0121f5b75a55633571ac74316b8ede73fb774
  • SHA512 a91626bc6021c34cb61530c9fb72d355dab63236c75a912bf0f821ac19f7a9d315f8b76311f9292fa63456e2f4e3b18d282aaf956ae93ab225fa20edbe156fc2
  • SSDEEP 12288:5w5MOiV1DtFkBbn11lwRl3l3ZVq+SZGPpatO9IpDDDg4MKExS0ISen0rhbYAgJSX:5w5MOiXJFAb11eRds+vPIweH4KEx5Pe0
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookmy18discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2