Extracted

• • Target
    99841e88256948ff1d5f4c60599a3cc72284206864f1511d2ad5edac390e08f6.exe
  • Size 959KB
  • SHA256 99841e88256948ff1d5f4c60599a3cc72284206864f1511d2ad5edac390e08f6
  • MD5 72ce2534720da0c0710a3b92a4a87a09
  • SHA1 883d9f358f7f7df555ec300241756c68e04769f6
  • SHA512 0931f8f8b46fb4a4daf5af86b3b2d29ce5cefb6274c672614ea76c86890468305663b4e8f28f82812972e0d8cd687a49faf38cbbfe5537571e1ea8f0177a3a54
  • SSDEEP 24576:MngjRTpfub30eDkTtdwc8ikR/ECNV8Or+:GmdWfwdwcBs8SV8o+
  • TLSH
    T1772501981A19E647CA1517784BB0F67403AC6EDDB902D22A9FDDBDEF7D36A040C24393
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  ge47discoveryexecutionformbookratspywarestealertrojan

  • Family: Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2