Extracted

• • Target

    Quotation.exe

  • Size

    6KB

  • MD5

    50fe48f0bc657db241591d1596b76e42

  • SHA1

    ae3d082ba3226bec627c0513e5162db268c443ef

  • SHA256

    6a55bd03035714c63cc56eff840bc96de7ddcd5f92fcef1965c1d9babd7604dd

  • SHA512

    e7feb56b61c5129602ed86569331c01879f1245ad828b3cffb872679f457bcce5b94acf800cd3c6b339252070eea06663f1f17e049f55a35382e78abf1407db3

  • SSDEEP

    96:Tjv1PUI7scQ1d2W0mJfv4L+BWefYnYL/1YN+FnU:/Z5E1d2WjJHBW7YL/YL

  Score

  10^/10

  formbookg2fgpersistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2