Extracted

• • Target
    URGENT ORDER.exe
  • Size 791KB
  • SHA256 270da7ba03177d793879ddc0272e94a0003e9327298879463693f7b78f199e28
  • MD5 4498a75f6f27e3e03a0b14ba933c0a06
  • SHA1 259d54f92d825925cf87c9057d5d0c47a0c50bfb
  • SHA512 16270ddb916f438bac3c54112ee908ac0ce2c0acf7dc0533f02e6dc49c33a8fb33272aed3e39ce11dbe420fec9ecf577752ed4bd6a203a33630f013ff912fbbf
  • SSDEEP 12288:PXc87X+bXPXST4Fof1XUhRtK+CVIN2X9yKBg7vj3pz17:PXcH/X4ypoig9yKe/5z17
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookij84ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2