Extracted

• • Target

    PO 2000057560.exe

  • Size

    1.1MB

  • MD5

    29a50ff6397fe78b930c764195a1d9cb

  • SHA1

    fdb262c5660dac2a6b30e8a488a05eec6b622151

  • SHA256

    02f864baf71847c5832c94f396bb14ba3fd5c1b7d96936427c358f37a6cfa105

  • SHA512

    d38c8319eb8dbe49479c4352365a066880b2b40f29a527dcf852b7d8117dc6ee1c35bdfd7830de342242154a4f8baa2ede414b5946aaaf70b43d37476750988d

  • SSDEEP

    24576:iAOcZXp0P1xtOcW1JhC1MIDV2riu7w84UopeOH+2UNUquptQZNR:oL1jk+V2rtUUbJZupA

  Score

  10^/10

  formbookoy10ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2