Extracted

• • Target
    35460d0ed6ddee3f707f73eaacf6e49f09f789bdbf460c21f491ba2ff2bb78ef.exe
  • Size 890KB
  • SHA256 35460d0ed6ddee3f707f73eaacf6e49f09f789bdbf460c21f491ba2ff2bb78ef
  • MD5 d5198b6de7d0e9cf41406c470357ccff
  • SHA1 d84be06391ac8934aa8c13663a20932056517595
  • SHA512 7ccd060ede1b23192189961c353e5aec776cbb6f33a798cc33beffda78e2f032d78359df124b6901b5fcc7aa41888712596ca0f9df1e71b616120490760c98c5
  • SSDEEP 12288:O9EC7A2mVfXgyZ6abe3R609gTjQ27Cw2i50NS89+zfbBr+JPga7V/rJzLBjpWeI2:aABmyJq6qsj7Cw2i5qlE/CLtp4F2
  • TLSH
    T18C1512F026DDE546CC6643F50DA0E33213BA1F6AF521D35B8EEA6CDB791A3750918283
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  be04discoveryexecutionformbookpersistenceratspywarestealertrojan

  • Family: Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • SmartAssembly .NET packer

    Detects SmartAssembly .NET packer.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2