Extracted

• • Target

    ADASU AKU-GIB2022.exe

  • Size

    1.3MB

  • MD5

    e124339f08506d6b5bab4d071784a65e

  • SHA1

    bcac9d8f2919ed3e57ad78f4a5c999b3b9faf88f

  • SHA256

    8f8813e3ed0cdb3ac92de8e6003bc83c0ec859fc717748cab6a45f56a98a9201

  • SHA512

    0d8c3949cd7cdd07264398dbf9a6224c6ab40af0ee81d1936bb2a436f25981309958f5f9c405ad5553890cf94dd7f55667a07b44336ffefbc90c0127e8825df9

  • SSDEEP

    24576:rAOcZ8hI77JrtcZ2iYLwHQciT79xUkjPV99npuezy71oporahX:ta79pcZ2iM+QHTjUkj9fZe6Gc

  Score

  10^/10

  formbookmh76ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Blocklisted process makes network request

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2