Extracted

• • Target
    New PO-0095.exe
  • Size 1004KB
  • SHA256 2ea9924d172719ebf9dbf3e5edb2c87c31e4e3f740b877e8af2454c6dc93d8d6
  • MD5 32ce6be2690e06880778dd50dd8747c0
  • SHA1 5806e36da0f28a3c9c96e87c31c2e55604429152
  • SHA512 061186740f275286c71eee6419e41de63cabefb91ac79f8665813927b5d1a2d007e20780cd3e22f3f94d6fe32d0a65dfa1292094307328aabc7d3ea5274c7844
  • SSDEEP 24576:yVpqe5CPXiSRF5KbeSt5hYOoorVI6U1IqPC23liPgWcsFeP:yVB5KSSQbLt7YOdrWpK23lshFF
  • TLSH
    T1BD25DF686617DB37C5657770CA73E2F406692EA9E810D23F1AE97DBB7F31E300914282
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  me3tdiscoveryexecutionformbookpersistenceratspywarestealertrojan

  • Family: Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2