Extracted

• • Target
    Quotation.exe
  • Size 810KB
  • SHA256 490dbc697f6a780e942c8caa7d853da4ae29078059081431e7cf6376caae79a0
  • MD5 937e58e663ea6dd973dfa081d8e0fad1
  • SHA1 e5e9034d790f729c0a377aa4366a836209f7e45e
  • SHA512 3729fc567993080bfa5277bcdea6232bc957230705b4106ad7e0efc3e43d55cd8e6ece8e6267d864ad954ae6ae97ba8b77414bbb040b285229f690a8dace5f34
  • SSDEEP 12288:xMufEu8C3s184TSiilcBHNCVtEH2NgAN9qe89vq1pU87rPwNY:ti8wzw/ViWSmDKq1P4N
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookoi05ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2