Extracted

• • Target

    821b0a63cb6261b46c7e269f35279510N.exe

  • Size

    621KB

  • MD5

    821b0a63cb6261b46c7e269f35279510

  • SHA1

    04b02753ecdce9c5a1b49a06fffa17a88398b1af

  • SHA256

    c162a926bc48d37970c76d3ae7afcb32881f8af7c2110b5dadcf6157c1ab3012

  • SHA512

    854026466fa1f54041ab3f5e15ff00bad98370c13bf54965d171e8eab326fdddfe8717f9d44efcf5cabf691e5782465dbea2a7531c2d74f07c2c23e2ec03b818

  • SSDEEP

    12288:m4Ox8GgReg2DlocqHPOK9pMSzFDOct8FwVxBa6QhmaTpr5Lka0KVjndCWkR:mdx8XR12uLvOKdzFZ8FwD86Spr5Lh/Vg

  Score

  10^/10

  formbookss24discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2