Extracted

• • Target

    tmpbdojnprv

  • Size

    1.1MB

  • MD5

    d9c1894f13bb313d6777822843829dee

  • SHA1

    ae0d2dcb7f536c304c2f1a7ecef450bd91c382ec

  • SHA256

    96df49e0deef67a2fc032cf1018662606bdef066655c1f31f135ccf8e68bace5

  • SHA512

    3585c56f9b27dbeec0c81e46f3d2b205cda05c2f64ebc9765a035d444fbc8d9b8e2441b36a0ef83001258ba5f53c20c847327210478f25c496703b9508c10adc

  • SSDEEP

    24576:hv85UkZhzAzhWJA8L5rRj1FnKT/TA58hgsxjsHiO9zEtgfUaye15DJ4SFIL1Py:tzTA58hgKOi0zgjy5DKPy

  Score

  10^/10

  formbooklsg6ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2