Extracted

• • Target

    8431df429e82a311e33fe085f3b419c0N.exe

  • Size

    633KB

  • MD5

    8431df429e82a311e33fe085f3b419c0

  • SHA1

    0358de41f691dc3ead6aeeadb0313f867a497167

  • SHA256

    33779a75da1af9c5f45112370d3dbd803e86fc7b88bc5a1f43a7b76fc9d887ab

  • SHA512

    e8bc2de8a2e62a62dc6b7e5501cbb8eb36722a231542f6b4c631312b39c7c87c8f279291cf9988410dd2e89a746628960c55bef7f529a924422b6863ab048c52

  • SSDEEP

    12288:2zPAiSeURm5gpmNU4EGET0aisK0HeSrEXSI+nhtVj4wJxNJJXlCALkR:2zPAOUegga4BkhNrHeSrUSIktVjVJv7c

  Score

  10^/10

  formbooksy52discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2