Extracted

• • Target
    4a3a63e28d36ef40fb1dd6897480ddb1.exe
  • Size 258KB
  • SHA256 8fc72b5ec8701ea1681ab2b170652cc65a43765657919f4fd104f967ff944e21
  • MD5 4a3a63e28d36ef40fb1dd6897480ddb1
  • SHA1 6980ed874467f249416c52dd970aea59bb942a13
  • SHA512 c80e136dd88e509237138605f0172e8b9cbbeb54a244dcf7113bb6d89a443ed7f4be2c7dc07c40927965210249ac612bfacc6ec5aedad40aca3e74cdf28f8de2
  • SSDEEP 6144:mbE/HUbyNxUYQUwCp3sU1w2e7NFPchHwvz5KEpbS:mb/ybrp3fwOhHw75FS
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookwzm0ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Blocklisted process makes network request

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2