Extracted

• • Target

    SecuriteInfo.com.Trojan.NSISX.Spy.Gen.24.19862.1158.exe

  • Size

    382KB

  • MD5

    01ea499cc03c239b5a76e6bb41ca0a42

  • SHA1

    78ab722e5695931698e73fbd4b2f3ebbdf6c3967

  • SHA256

    3eacbab11c9f00e94b06ad4feaf37264839faaddb10f611207ae44a460b5b6f6

  • SHA512

    7ffd52908f28a1329c1a068601266af874ed19535809e4abc09a043eb4997401976ba2d1ba2678739508e51df0c91497f5323ea5afe13d62eadeb1d90a43bbd5

  • SSDEEP

    6144:NweE09eX6KKKKKKJEKPMlGWj6C/o1hEMRyjdvbU5R+3zFe6I1dsog6o:aX6KKKKKKjPMltj6rUjjERWehds6o

  Score

  10^/10

  formbookk056ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Blocklisted process makes network request

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2