Extracted

• • Target

    file.exe

  • Size

    626KB

  • MD5

    031281aa0667cba260ddad6f77c89ccd

  • SHA1

    17b747e3e1de9296f862d522a9664046d2d3469e

  • SHA256

    16346ed15b2d60e072d99cd110e29c8bef43483b9f8a5f9246123750bc0073d6

  • SHA512

    f4715533c2f535964dc98f581887abc1a9daf68f913b9b316762ddf169b4209458fbeebed8173fca65c7d4732087bf0b0e4369fa440cebd45772d77559820ea2

  • SSDEEP

    12288:bItKcNGvH3x+D0NDO6D7zkoT+lqp/7Iu/O2ybZx9Y9rl7jjGHS:bItK9H3xbJZlT+lQTD/O3BArRCHS

  Score

  10^/10

  formbookhenzratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2