Extracted

• • Target
    PR_Form_20240809_145815.exe
  • Size 633KB
  • SHA256 33779a75da1af9c5f45112370d3dbd803e86fc7b88bc5a1f43a7b76fc9d887ab
  • MD5 8431df429e82a311e33fe085f3b419c0
  • SHA1 0358de41f691dc3ead6aeeadb0313f867a497167
  • SHA512 e8bc2de8a2e62a62dc6b7e5501cbb8eb36722a231542f6b4c631312b39c7c87c8f279291cf9988410dd2e89a746628960c55bef7f529a924422b6863ab048c52
  • SSDEEP 12288:2zPAiSeURm5gpmNU4EGET0aisK0HeSrEXSI+nhtVj4wJxNJJXlCALkR:2zPAOUegga4BkhNrHeSrUSIktVjVJv7c
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbooksy52discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2