Extracted

• • Target

    Nueva orden de compra.exe

  • Size

    1.1MB

  • MD5

    7280b74e4cf0685d974bbb8d60a57ea0

  • SHA1

    272afcc621eecb76b7986fa80fd4fc235adfde60

  • SHA256

    cf5d0eb741adc67acf2cffbbef91fb030c94aca534d7a6b95efdbace11b4a62a

  • SHA512

    6ad2d2369b2339d5c4ef9f91fb13de42189a9b493da98e6d495980017e0f4e97827a4606dd590cc12aca22d150b974d403602d2351381221bb82a763ba680b11

  • SSDEEP

    24576:rVspUwf9hhQP20Nog1tChybY9GygPmWXrq0l4EQUfIHTw:rVQzVhhMNoQl0EygPNveWIHT

  Score

  10^/10

  formbookd2g7discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2