Extracted

• • Target
    New Order.exe
  • Size 80KB
  • SHA256 9bebd6b8400a02ec36958c8cf06d3abc659b462d482fca3df8a3a64e42b3e234
  • MD5 0469a27bd0ef6dd387ba38e47614cb6c
  • SHA1 5d166d7653e340585d672928097b16fb11c35533
  • SHA512 69a1a526f76ef044101ef57b1a410a7e55faf3ffebecd0f5f08b2f93fa50ac91eb7ff1d491f5080623e281930d6abde9b915f32c2dd2b8502a4a06d3308fdbd1
  • MD5 SHA1 SHA512

  Score

  10^/10

  ratspywarepersistencetrojanstealerformbook

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook Payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2