Extracted

• • Target

    Payment Reciept FL202306150003 Request 10273 Konturteile.exe

  • Size

    640KB

  • MD5

    ee8c76a8b405027bc5307c4543d7b86f

  • SHA1

    5b1bec9b55e8f8d94989c1a627a73899c5d6fcd2

  • SHA256

    8352beed8fb5f5823a3ea3829d7e845a3fd3c53535dfb4a13fa0d11e01231912

  • SHA512

    fd9915466193d3370f5fe4535b51e0c506e6998ae04c64d7aac7d5c677f74f5e2fd8cdb19b2209fad995993ea6cc1bd5e773a1cd432b52db6a8c081a17e7011f

  • SSDEEP

    12288:d3khMOoltiJ3QNnyYm6LRNVjXMV1Nr6UdOJHf6rOcnJ8UJSvbsBFqo7qMasQ3CiC:d3kh5oDiJgyYBLRNVjm+NALnJ80Svbsr

  Score

  10^/10

  formbookcu29discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2