Extracted

• • Target

    neue Ordnung18082021.exe

  • Size

    1.3MB

  • MD5

    ec16216182b54e48c108ce8dd5e70924

  • SHA1

    ebf738f475e46fd56fea6e3090f8ef4d0337e636

  • SHA256

    a532458e37a48eb5222790c56e237b35a6bcd75268527e466890123e4c4778e7

  • SHA512

    26eadb21ad825441da2fae1b49738bbb309583cf0be8a2ca6bc917b9eac959a477f971416cfe00deee7548c38aab03377a4a9e3fb6337c4ea28883276d1aa1f7

  • SSDEEP

    24576:k+57Spg/hRCtLUFIDYrSj4S7izveUnhzBqjHg851pf1s89UrmMnfk/iQ2+S0d:ksSS5UUWDYOj4XzeGhz+H/N9saU9fk/r

  Score

  10^/10

  formbookodseratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2