Extracted

• • Target
    aab14e3152a99083841205667d41213155d61e64e734bf6ead723f3e702b14a6.exe
  • Size 1.0MB
  • SHA256 aab14e3152a99083841205667d41213155d61e64e734bf6ead723f3e702b14a6
  • MD5 afcd40cbdca11cf2c64b43d895584ffd
  • SHA1 df15d337ebc8a22e9208455dfbf67f22d05a9611
  • SHA512 18dcb234e224a2ff7b956c2aea36af1ecba3a770455685dbc10c612bd346546c356d887aab8ab239e0bce5f34ecdf31613a73eec2ea44636f3f27a933631204c
  • SSDEEP 24576:r1RPOd5OPMxfsjcPPgE/WKgXLowDiY/9IMl7:h5qOMxVB/WKxwz/9IMl7
  • TLSH
    T1AB35D1AC3214F88FC853CE728960EE74AA606D669707D30395E72DAFB91D5879E041F3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  dt93discoveryevasionexecutionformbookratspywarestealertrojan

  • Family: Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2