Extracted

• • Target
    dc969684c8b2051843d1db4048e2b13e366e769dd8e97a1dc63e1dce0ffcb954.exe
  • Size 613KB
  • SHA256 dc969684c8b2051843d1db4048e2b13e366e769dd8e97a1dc63e1dce0ffcb954
  • MD5 37bf2a92bb8d4bcb4bfa8ed52a33e3bc
  • SHA1 632e61a3d9ce93033dc4cc39ac15e07060a92c19
  • SHA512 1613d6dc5928899d19a490920c2afb2732392286f2a797dc1abb0be2f87bff0579db2711a3146b9ef392e737bc802610ce4d6ccfdd6e996b704bde7ca354790f
  • SSDEEP 12288:hX0OTMfwHGASC/vNULT/F1jhsqNp4cPau8+7vXhI6X/Wg+D:hgfqGASQNULjnNp4bQ/XugA
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  gw28discoveryexecutionformbookratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2