Extracted

• • Target
    da187410b85616c9b57bd1ce4efe733bc0149f50fd88624373631fff301f82ff.exe
  • Size 1002KB
  • SHA256 da187410b85616c9b57bd1ce4efe733bc0149f50fd88624373631fff301f82ff
  • MD5 7de577ee2482fd2906e13019020393b1
  • SHA1 bf95a6244fb51c483a3bbcd14c34ee8218bd588f
  • SHA512 2f62dc457c0ff95756431373a444c202cdee05ddffa561ebaa169d0d9fe579473041eb5af574c54c998cd1167d40fb0741667a1adf986dd5e409e44cd5bba9d9
  • SSDEEP 24576:SO1mGqPUjRLdFhC5Uaxx9ym4uO3OG0jw1YS4L+k8lb7:SOIoYXh4uO3OGh1mL58Z
  • TLSH
    T14025E02814274601E9F17EF05E70B1F46B246CAAB139E1295FD20DEBF277211BE4672B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  ge11discoveryexecutionformbookratspywarestealertrojan

  • Family: Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2