Extracted

• • Target

    NEWorder2022FILE8876.exe

  • Size

    829KB

  • MD5

    443188c8e6b449066d99f49d1b715e92

  • SHA1

    7ebde06ed2558ad169e7b779ac2f7bc8bc758ef0

  • SHA256

    15046684df239f63119e30eadc6a71abbfece9080bb3a6a1d4f7b0899ee47409

  • SHA512

    1c063339b87ebe67daf14c58f20cbe917885d12ff3d1161e8e7180752710819c5b1aea92b104130d3a42beaa5906691938656c0f394591d2e2ba3beb5de31fee

  • SSDEEP

    12288:D3YNF3wX+sJMgCEdhJlxnFrQ9dI640gfHtY/h8uSW7rbLxPkgUUj5TX:j8GlJMkdhVnaHI6ufNkUEpaE

  Score

  10^/10

  formbook4u5apersistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Modifies Installed Components in the registry

    persistence

  • Uses the VBS compiler for execution

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2