Extracted

• • Target
    Price Request List #GSGPRO202600197.exe
  • Size 699KB
  • SHA256 911b4fe6d1761eed5bc7ade69ac55b3c8f726cbd7e3d613ea34bd2bbf107e9c6
  • MD5 3538ff52e4bd1fb7c700d3a68a4d7c2b
  • SHA1 f5709ca7b5cb96bb8cc574b6cd7154cab8de80b6
  • SHA512 8fb1c1bffebb030faef7a86c5df6e45593f798abf59b47cdd91b49142fc797d00f99463a98c313fa81c12c6d53a69e7ae335d67dad67b149fffbba6d5f2f1d04
  • SSDEEP 12288:hTYayIc5uayzMjThnwSgJQ4Op3qei373Q+NX+L9GKG7:1uIiz5nwPzOsDJ4C7
  • TLSH
    T170E4F124676BE913D4B6437909F0E33043B1AF5CE513D31B9EEA6DDB3912B846998383
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  st21defense_evasiondiscoveryexecutionformbookprivilege_escalationratspywarestealertrojan

  • Family: Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • SmartAssembly .NET packer

    Detects SmartAssembly .NET packer.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2