Extracted

• • Target

    582c078327541d1459228aebf38c9471b78e3a2c03cb9c375622209221970709.exe

  • Size

    630KB

  • MD5

    2f2be19e7df6549682b6db140841ef0c

  • SHA1

    46b52ec65561265ed8936cbe1a4fdf417d87d629

  • SHA256

    582c078327541d1459228aebf38c9471b78e3a2c03cb9c375622209221970709

  • SHA512

    9c4e87048ccd46ec60ac80a667384aa15b3dcf04ff5f8242918b1ebb9b9f8cb452c4d1f6d7c0712d8c90f0acc616d50a94cf448e28d8616e03f639e86192affc

  • SSDEEP

    12288:+cTjvOn6nzxQkjZGhGZJd60sqQ0Om1lEWnBynQa44F8+19tNW3:Jj2n6n2ktGhGcVxyyMByQj4F8+19tw

  Score

  10^/10

  formbooka03ddiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2