Extracted

• • Target

    Nuevo orden 1.exe

  • Size

    555KB

  • MD5

    b9ba47bd36eddc3ec6690f867f4f065c

  • SHA1

    145372771d3ad06c2d7e1bfd8cee311fc8b4c000

  • SHA256

    035dd068094e680fb06f62eb2b838b182d29df63883906f0031444f1bea56507

  • SHA512

    d5e4d9389c85a890c90660353ec842c2e7c2ac854f171a4f760d74d200c946c37868c3d1b8d54bb1f298bdf174c7eca4c18f3340676905f20330c37013acad99

  • SSDEEP

    12288:7z90jNqYHj5TDlbC3F5A+56YYLjtY9KEj/CeB:7ulYJm5IKEj6

  Score

  10^/10

  formbooko27adiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2