Extracted

• • Target
    Payment Reciept FL202306150003 Request 10273 Konturteile.exe
  • Size 640KB
  • SHA256 8352beed8fb5f5823a3ea3829d7e845a3fd3c53535dfb4a13fa0d11e01231912
  • MD5 ee8c76a8b405027bc5307c4543d7b86f
  • SHA1 5b1bec9b55e8f8d94989c1a627a73899c5d6fcd2
  • SHA512 fd9915466193d3370f5fe4535b51e0c506e6998ae04c64d7aac7d5c677f74f5e2fd8cdb19b2209fad995993ea6cc1bd5e773a1cd432b52db6a8c081a17e7011f
  • SSDEEP 12288:d3khMOoltiJ3QNnyYm6LRNVjXMV1Nr6UdOJHf6rOcnJ8UJSvbsBFqo7qMasQ3CiC:d3kh5oDiJgyYBLRNVjm+NALnJ80Svbsr
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookcu29discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2