Extracted

• • Target

    df76258f5a92817111c47c370f40806f0e913fe8a8f05dc84a8a3f5e5c8464eb.exe

  • Size

    588KB

  • MD5

    d57f189db1e00f4bc3bf0697023c763d

  • SHA1

    c0696cd65511957e04e61b79206e3e642e5a8992

  • SHA256

    df76258f5a92817111c47c370f40806f0e913fe8a8f05dc84a8a3f5e5c8464eb

  • SHA512

    85ca18aba5034317aa2f9aac413275175b59948456d50b99234422638668d2c26c553067f757aa3955bd586c04f7e75bb5ae537d6094eb70c3ef8f1db56e49ab

  • SSDEEP

    12288:48XLCsp4ppptlpMkQ28GKkpeGHO8FG0tF5RlCgnKl0kEVjun+BciO4d0N+2FSV:/XLCsO7ptS/kpeq+0FLCrVEVju+BciOc

  Score

  10^/10

  formbookbs03discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2