Extracted

• • Target

    New order.exe

  • Size

    908KB

  • MD5

    624e535330a688d0e78e8a4e4ca70d97

  • SHA1

    07161ed138f1ee9b5463391d6398b8f85a9dd2b6

  • SHA256

    30af910477a154c4b07fa1cbb928f78bc7d714329f725b2a1f2cf7f3139ce351

  • SHA512

    ce5e3b37da471efac83f2c9b0f1554756385af0cc68589eec427924fd7b61d561863c309aca01f04019c887196e9da3c2e4396a08082b667edae0b1a84536fb3

  • SSDEEP

    12288:h8SCnWMYou4yCyCx++xHDZqhxGrK6PJ9UqOMBXaWpelivORs9iV5V:h8SCnWMvyCyC8+xkxGnDUqOM1Gi22k3

  Score

  10^/10

  formbooka01ddiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2