General
- Target Factura electric correspondiente al pedido GA103209 PDF.exe
- Size 981KB
- Sample260702-pceecaf18k
- SHA256 0b3236531c608af3cdb33b3f09ab0d5bbd61f67cc341faa92c1c2cb2258bd409
Score
10/10
Malware Config
Targets
-
- Target Factura electric correspondiente al pedido GA103209 PDF.exe
- Size 981KB
- SHA256 0b3236531c608af3cdb33b3f09ab0d5bbd61f67cc341faa92c1c2cb2258bd409
Score10/10Family: Formbook
Formbook is a data stealing malware which is capable of stealing data.
Formbook payload
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Accesses Microsoft Outlook profiles
Adds Run key to start application
SmartAssembly .NET packer
Detects SmartAssembly .NET packer.
Suspicious use of SetThreadContext