Extracted

• • Target
    new order.exe
  • Size 683KB
  • SHA256 792bdecda049100bcddb388c74b9fa5aa21d30a167786f1e5a99091a6e77c430
  • MD5 6d7e6654f32d5e775819b21895c968b1
  • SHA1 e5c4522e22314b1b34a726bec182201556d95225
  • SHA512 c4fb5b11eec0fd71ac928ddfddc199d7240e9088f84f519b8f2cda43cffdca0d05e7c29de55e1f63c1548d24797447ad92c8df334a043cb5847e661ea879d2b4
  • SSDEEP 12288:q0e4F55OHTDP6ko4H93fe4W5LLqIJnrC7pXvwzzcVh/x2SsbDWb:o4FXOPRve4W5L2I5ruSfMh2Wb
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookk49sdiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2