Extracted

• • Target

    list of new order.exe

  • Size

    666KB

  • MD5

    fc1d67e2e18b6372b2623c304fed7088

  • SHA1

    ed2dc80e226e31132da7aaccd6e8dfef698199d7

  • SHA256

    4336ddb80f3875340305306f98bd57efcb38a2182153d71308957167a295c070

  • SHA512

    e73ea61d5112e7ffee010c549ac58777c8a017390fc9e508c09e6d0dd50c3bf3b61ad9aea3aa05ccc247ad82428a22413c3894798fa2e4bbd1906ce06ce68292

  • SSDEEP

    12288:KjCKOSH5xZrMVg/0+hGYUD+kQqBCB8NLn:45Mg/FhBizLn

  Score

  10^/10

  formbook3nopdiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2