Extracted

• • Target
    Para transferi makbuzu 2131RI50089500.exe
  • Size 1.0MB
  • SHA256 4e635e08da9caa7a6c08b4d401acbd9141bbde92d9f5cb5aafa03d6706cb228b
  • MD5 447f1e6ff2c970982e8e8f1afa3adf3c
  • SHA1 57251d9a0619f4fedd03e8e863e4a2398d3cb98e
  • SHA512 66abdc0b7f3507cc2b66b691db7b2ea040beb1a6894c4081ffabb016362f189b18c5309550a461e39c16ee7d41a3a2c1e9edadcc1b3dacd3d0af97c34538d9b1
  • SSDEEP 24576:PMg8+gQeul2iChzoJmXyJtN/baW3et6fM95OH23AuZ0:0gdb2iChzoJvDTu6UKHZc
  • TLSH
    T1712501556B58CD41C5FE0BB85AE0D33507B84E0CA516E3268EE4BDE73C367966A0F283
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  ge47discoveryexecutionformbookratspywarestealertrojan

  • Family: Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • SmartAssembly .NET packer

    Detects SmartAssembly .NET packer.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2