Extracted

• • Target
    NEWORDER.exe
  • Size 590KB
  • SHA256 4a29c020657514662d82cf92cf660922d45184e961473f08326817611afbbb94
  • MD5 5c45a9c7ed0522b874a6b277a970fcdd
  • SHA1 01a55397aacac6bbd33c4e0a415c99b04bbd4b7a
  • SHA512 e0279dfec3ffdaaeeabc2c9ee1a09932b726f5dfb3a239470308715a9b6091f0fc4e7bfd76694aa34f589e0d796f21f8b131bdf1db2bf79dd8682078d49bfe01
  • SSDEEP 12288:4S+iIkirVw9iEoElSoERcSltDrabRu6XDyjPu1ulxk/ReneD8bQb:4h2ihlEoGSDlVrV8WaulCwe0I
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookg29odiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2