Extracted

• • Target
    Orden de Compra No.451566.exe
  • Size 3.1MB
  • SHA256 b819347078fa3ef6b874c0f8acbd32e0d153442ce42be82496ad15ae4dab5a59
  • MD5 17edb39cd907d5809f6a6ea3eff326b2
  • SHA1 24f9c1e37ff3a6a360ebaea8dcc5d36dc6e75d0f
  • SHA512 3adfbd764089041067baa0ac31410971127c4d2033cefc87bf01fc20af8bfccb61d3af4add05921df1057a89b7493993ecaebed533847df62feb3c2e92ee9f5d
  • SSDEEP 12288:Wd2QJ+r9SExqlYdjzKQpQD6okMI4JX2x1MyYJGCV02v3Sm08AhrcNC:U2Q4r9SjYdj3FoLOyJG/2/B08AhrcNC
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookgy15evasionexecutionpersistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Formbook payload

    rat

  • Adds policy Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral1behavioral2