Extracted

• • Target
    rhdgDI6EiUxMKfh.exe
  • Size 680KB
  • SHA256 3489a2eab1c57d0eee2ce6e5773e1f4f53ee6e5d8963e0099efc7e190d0c2f1c
  • MD5 36ae5623c88f6c47b0a161a9f342c936
  • SHA1 939687646556ad37b9dd14aec43e6326be21e7ce
  • SHA512 56b87f662fd41103e224acd263a8a712ad3b8cf16bf3c8e887cf235ef684ce428e79db33e271c056ee9e42bb0a57579e41ae7c09d51e322a2c008a774a9e59d6
  • SSDEEP 12288:71AK2iN0f2Thrx58BoTGKdCpE19GlWvtxvRL/iVWeoBhJOCrGBpWV05QkR:v1WfKhrr8yT9dl19Gk1xvpBzO7
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookhi13discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2