Extracted

• • Target

    ORDEMDECOMPRA.exe

  • Size

    646KB

  • MD5

    310f17fe6c4e3be18895f171b3c0b614

  • SHA1

    6151e97b8f53a524205daf13a212b0a74eef7303

  • SHA256

    1ca6029a90c9b8fcda0505d239c484552125ba7c4c5b761893f8e39360313212

  • SHA512

    06b2a5995a6a85f939f9e8724d333dc47f9e1d44215536e8e9b6e0c7781e45048d30e23cec22017449f80178d9e0710c973957ae234752701de0d4243d255357

  • SSDEEP

    12288:TCfiahiNFADwhLVYIXYoEYGDzlPkMctzq6ya3LMWvxYAuhchnt:TYi6iEDwhL6IIonGtPkLA69DxruAt

  Score

  10^/10

  formbookdn13discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2