Extracted

• • Target

    439e270481fa6cf85666be16e0f41dcbf80e2515b304573591528a1cfa3d9758.exe

  • Size

    656KB

  • MD5

    21439ea18c8518ed0f7e3b94551df520

  • SHA1

    fb49e10c82891b2c6ac90acc2c0a1d4463485953

  • SHA256

    439e270481fa6cf85666be16e0f41dcbf80e2515b304573591528a1cfa3d9758

  • SHA512

    e71f1e222dc044a0a41950a58862abc9f4652dd70e64a77dc14993134fedc8467f147fda12726915cb6afd4b0f1f0d52e14bdc396153c705f02f8930d3782bd0

  • SSDEEP

    12288:xdkIYyOn6nzxmLvraF2UBmNRURd+bSuhh2oDywXlw62C9ygXCw+eAix5I:fY9n6nmv1UBmNmRQbSs2oGYrSBNs6

  Score

  10^/10

  formbookm13odiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2