Extracted

• • Target
    PURCHASING ORDER.exe
  • Size 621KB
  • SHA256 c6b1ba9ffe05a03d88f24ae7fe9c3543976d9c392862d4c2ca6ca2d53c4befd6
  • MD5 6daa7c8e19391e18c373678daaf6f1f2
  • SHA1 f4173eea04bd72474293a1144171771bf7575578
  • SHA512 96812cd74ade57ae0724e10f30399aa1d0456dbcdc12948153b0935d469b52fca23124b1281cee82e59281b2ce07ba6fb518248b14e1be3e39fee032ae347e19
  • SSDEEP 12288:RQiuaKWgPglHRO2/IJeDp3kQHurvjA7ZT2WLJyV6YN9Z5:RDngolHg2/IJeD2QH68DoV6Y3
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookhy08executionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2