Extracted

• • Target

    payload.exe

  • Size

    185KB

  • MD5

    14382242e215d139c77c0ee9bb0c7ad6

  • SHA1

    3951322a28787e4757fd3715d518103d6c054960

  • SHA256

    5017913bca4c5c1eaf5646e3983f9d8fc4e52f4a66406f46f3029952ae1fde70

  • SHA512

    1f4eef4d4685ca466702b45fa163e31089c031d2c491b4a14279bf28cba64a1aada928536df2970399510c4efb093ab08c7a05f0223fde66e751e20c26e07a4b

  • SSDEEP

    3072:yXoVNpuuK+ArjKxjCpZomp/04AkJmHrwF8gUdSl5xCZqnr/xA3unPu:bfp5SZow/04tUuUdeSqri3gu

  Score

  10^/10

  formbookknntpersistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2