Extracted

• • Target

    New Order list.exe

  • Size

    601KB

  • MD5

    054478ec1c85be8ee69f90233bcf496a

  • SHA1

    20c7eacbfdbf82277cae11af7472b907b5188496

  • SHA256

    20973191d7a161b20753a6dfbb0113761bdbfaabece56d6725dd476de4402e77

  • SHA512

    f1f97d639d8c904870e8cce62eb666bdb16621123a98cfbc0694dc4f2882b0f9d5f8d90575af18c0eaabe01be18cd0931338867ff6f58fbc9afcbc13206dffd0

  • SSDEEP

    12288:iMyC+M4oTxGaximtTT20EaF5yIyN+we7WAAS9fFxIw32Q:iMyT7kxf0mtTTKoEIyMFJZFxS

  Score

  10^/10

  formbookmd49discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2