Extracted

• • Target

    6086e2101717fd208b1f2b27d236d242

  • Size

    586KB

  • MD5

    6086e2101717fd208b1f2b27d236d242

  • SHA1

    b47eb5dad7656f4ea4f520bffa2df5217c611efb

  • SHA256

    712f4edfc3c0a1ad54060809bb9c39b0a1a355c8ebcb2cc377f100215a3f4150

  • SHA512

    63a7e54bfc1693cb8e818fb95e843fa8b791ef07996073326c944b702dd53e1cafd794bc46611836311e5e2b057684cef06998a40647cd0ba09ff4ea3da2f96d

  • SSDEEP

    12288:RfhpMHL/F+METLZNFKK/JFieyX7CXpCe9zJVGTP:gL/F+MEdV/JGrCXgeBJW

  Score

  10^/10

  formbookmj25discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2