Extracted

• • Target

    jestseewer.exe

  • Size

    1.1MB

  • MD5

    c2744465d0bedc9aa98714338225a6f3

  • SHA1

    3c50e3d5b630aa6a8015b349b4e18169b6c297da

  • SHA256

    d2a40596de9ecbb325f4d6a7dced2a1bccec1cc8f83f786940835e83e1bc05dc

  • SHA512

    2eacf21b0b560ef3e7652c4e543fea5aad247f35562f746c9cfb178822dba752c14f6dfacd8c699f69af2f2d0d18ccd1b5be1901a1f79fe5951db896c277be03

  • SSDEEP

    24576:iAOcZXp07zxTM+FFyvJjjcepfSjE+vRPGQFV0aBTjWFqwA4:oXzJZFYvhjdqvtGQFV9jWx

  Score

  10^/10

  formbookje14ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2