Extracted

• • Target

    Nuevo orden.exe

  • Size

    538KB

  • MD5

    4abca413b252753f1fe8d43db529eec5

  • SHA1

    003fc5e1e59ffb1247cc254edf8eff28d5e53044

  • SHA256

    a3165c54480303a31c1da6f186f955b3d5ff3e0dc3539993f134510b0a396df3

  • SHA512

    69828107fb63f7bc6f898ca1a28a6f10e17f5114ee4f52948a2500631198918c6719434d28f494294e81f7175f7245dab303fd83c0750f20e0f1c66ef8c5f90b

  • SSDEEP

    12288:JzzkD2hbbBC8sCAsGVaYYaP8ssugQ4mdeu9GQ7GYMmFq:JV9t3PNs/98s2l0GYh

  Score

  10^/10

  formbooko27adiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2