Extracted

• • Target

    NEW ORDER.exe

  • Size

    590KB

  • MD5

    5c45a9c7ed0522b874a6b277a970fcdd

  • SHA1

    01a55397aacac6bbd33c4e0a415c99b04bbd4b7a

  • SHA256

    4a29c020657514662d82cf92cf660922d45184e961473f08326817611afbbb94

  • SHA512

    e0279dfec3ffdaaeeabc2c9ee1a09932b726f5dfb3a239470308715a9b6091f0fc4e7bfd76694aa34f589e0d796f21f8b131bdf1db2bf79dd8682078d49bfe01

  • SSDEEP

    12288:4S+iIkirVw9iEoElSoERcSltDrabRu6XDyjPu1ulxk/ReneD8bQb:4h2ihlEoGSDlVrV8WaulCwe0I

  Score

  10^/10

  formbookg29odiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2