Extracted

• • Target
    7642aed9ec9bbb6c3f1ae1847bcc5e919828a1edea702afc88dc00107c5333c0.exe
  • Size 988KB
  • SHA256 7642aed9ec9bbb6c3f1ae1847bcc5e919828a1edea702afc88dc00107c5333c0
  • MD5 253a1ace8d377e5bc078d9449ed0b31e
  • SHA1 61d58426db2c1b8da78ce924a7ef1865007939fe
  • SHA512 0bb5e5211f856e01bf35d092fa5b0ec63d6e3c817ceaad4f947cbd4ab1a94449d85090049672eed8ae3f79a6571efb6bfc47a4a62a898b0d7338eb0442ab69e0
  • SSDEEP 24576:5ynTr+D2CCq7m3lr7TWJ2Ns5Z+8VHsMVm:5++DnCsOCJdG8VHsMV
  • TLSH
    T1DE25F1986A59EA17C99403B41AB1F17407ED6EEDB422E71A5FDA7CFBB832F004C14243
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  ge47discoveryexecutionformbookratspywarestealertrojanadwarepersistence

  • Family: Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2