Extracted

• • Target
    Skystar Co K.S.A Purchase Order.exe
  • Size 79KB
  • SHA256 90e04c24a8b6d9e6fa70821c848c1ccd7ff1f1bc2c78d19c5bc2fa09838a436e
  • MD5 63a88feb1f677875cf83e4d30efb1fb3
  • SHA1 b91017f2b81c3c17933107e8a71ce22a915f7bb0
  • SHA512 d099b53f52a565d4e348352b6275700226151a30ad6f21fde56cbaeca1f0fd986e9e02020315ac8f6ad7409809296d362a5bd7b3ce43edc3293f1967af5f0318
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookgc5jratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook Payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2