Extracted

• • Target
    Sales Contract USD314,298.50.exe
  • Size 694KB
  • SHA256 fe15f3c14abda3b58799555e7700cdf92ca912c5eb1db9f7eae81f60513ad5ff
  • MD5 5b4635891f9f1544fd414b1632c862d0
  • SHA1 f182a8aec051a8f8a71fb396b8e4532799f287fd
  • SHA512 97c64108b713e727797427029152f51e5d5d393acf1ca63a6bd32b36417f89a0caff1c9cd5900874cdb957d5ce104b0f4f6778b951e435cec63d70905bac9988
  • SSDEEP 12288:f8XTDN6jbE7YVJHlpfZXZPNF+yk1Dz9P8r8M1WeL4mBJDHbA:EXNZYLjJtNFM1BMUzUJD7A
  • TLSH
    T136E4F154721AC40BCA6413F85AB1E23117B95EE9B522D3D68FD97DEFB9B2F014C402A3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  me26defense_evasiondiscoveryevasionexecutionformbookprivilege_escalationratspywarestealertrojan

  • Family: Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2