Extracted

• • Target
    SecuriteInfo.com.Win32.CrypterX-gen.29279.29610.exe
  • Size 695KB
  • SHA256 8140718075fb3cf55e098f68fa8dfc75022a22fb658611503880b4c0c674d71f
  • MD5 0fa31cdedfad8f0dd2a1b1b6c0f1b957
  • SHA1 91148974cf0d66aaac1648b64404b9c24d141d3c
  • SHA512 f78905dd816c7f3f34ee5f2c3fcfad21383dbe58652fe475a13900b39482a2c6b14f1ab114d34a0f5e281aa325d676333d5fc1d8c55bcef25983a1aa5ce4b6e9
  • SSDEEP 12288:9GZKzvNUOBKYvI8hGayiRMhBcRiPNWZIBRR4LPJiyIA/ZMDPwffC0UNj6eWf1yrw:AOOyGPiRMhBciPHrRqJiyIZPwffC00O5
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookm49zdiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2