Extracted

• • Target
    f4233e364c6d89eb9c342d7e1647dc0c87feba66b700fd1fff0d89bd5b4a398e.exe
  • Size 872KB
  • SHA256 f4233e364c6d89eb9c342d7e1647dc0c87feba66b700fd1fff0d89bd5b4a398e
  • MD5 307b465ee59aa95d8c68223febc79a08
  • SHA1 b905664413ba0572a50e8bd813134c225c9a7c69
  • SHA512 48c1ae81f8983133dc08dafde63f160894e8df9761544261392a4743d7399988e65e64f863e2f7553bc5243ff5653b406c3a71c18f567fc714d8f0239d16860b
  • SSDEEP 24576:pyVaKVpTrC4mhhU039urKsEXrKb0iiPYmdUnOhcrbZc:dKVZW4gXurKsEKtiPDiOir1c
  • TLSH
    T142152379A788D503E6DA0B3EAEB0D3B106B43D94E912D95BAFFD6CCB38767061604350
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  ge11discoveryexecutionformbookratspywarestealertrojan

  • Family: Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • SmartAssembly .NET packer

    Detects SmartAssembly .NET packer.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2