Extracted

• • Target
    NEW ORDER.exe
  • Size 635KB
  • SHA256 7054e09e939cb0fe23629b11e08c8f299d54694babb5db98df8ead30a9233866
  • MD5 6fdecf51b428e772a8391a55c0a372d0
  • SHA1 5ad97478f9633b55972098042a927d285560a9d0
  • SHA512 006e98b878ac0055d4b2f8fecedfaa44691d4d36106d95d7660fb5efd4730333d53b4cd61823841e90c9a39b5f57cea376168669a874cb265e1c8e6ef6840276
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookratspywarestealertrojanpersistence

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook Payload

    rat

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2