Extracted

• • Target
    RFx6200224709.exe
  • Size 895KB
  • SHA256 a0f98f3cc53d1a6a7ad0d9c2df1de1ea370d97dd8af04230d9bb7fb2f76d705a
  • MD5 aeab6e6eb81f1eb3f0120e2b5516537a
  • SHA1 88c29b0c509ac28d3e788143f6138b586b9b9a26
  • SHA512 0ed80b0c54d6aac31ae8723dbec4142e7598ca120c3d65c334c87e18bfea774692a6675390fb0239489e6cc016303e6de30efb49da619694e9828768d5a48925
  • SSDEEP 24576:vuFCqk2wHgzr2LUcGudmuV0QhhxpLaAg5myh64+LD0deIH:cCqk2wgH2LUgdNrpLaF5Vx+fy
  • TLSH
    T17E15228173A52F9BE8BB83FE21D1640243F5AA5B7820E34C5DD921DB62F6B414628F53
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  ge11discoveryexecutionformbookratspywarestealertrojan

  • Family: Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2