Extracted

• • Target

    vAsA7v93dCn2vOg.exe

  • Size

    1.1MB

  • MD5

    b66e3047c2dd35c5f477b29c12bf8499

  • SHA1

    bda916b26b30ede5e2817c736afbc54cf06cc2b7

  • SHA256

    cfe210ae906aaa82fdf2bf3879af8f271897e5497c285140d1ca130b38936982

  • SHA512

    5ba8b8d10408bfce85c2e84d90f6f4e99195d1da14f6d76343e10c6de3144a4ff10d07f82bbac8588e048bc6f56fd00fd1a1d60f14d557f0051f49bb418f7938

  • SSDEEP

    24576:8xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxNuss8qAb+RWK:QqAqRWVg35/qroFdj

  Score

  10^/10

  formbookaxe3ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2