Extracted

• • Target

    malw.exe

  • Size

    656KB

  • MD5

    f5c733b27999dd54d54e9eedf1e85f4e

  • SHA1

    3bf0d9e4a4143a0fac4980fd13250a8d5653c946

  • SHA256

    ba5e984e73ebb4c1cfb3b0f194980efa3eb5c9cdeacf5b2956e4572701e62ed4

  • SHA512

    a17f30eee5a976b1a50585c3253d6b08720b9c69496c175062d0f86b51362bbb24875cd902e5bd89decefe852ad1fd665b221e7f523c85218578e2db89a7d2c8

  • SSDEEP

    12288:xdkIYyOn6nzxmLvraF2UBmNRURd+bSuhh2oDywXlw62C9ygXCw+eAix5I:fY9n6nmv1UBmNmRQbSs2oGYrSBNs6

  Score

  10^/10

  formbookm13odiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2