Extracted

• • Target

    DG2b3P7hOHbJs2d.exe

  • Size

    632KB

  • MD5

    3cbc50037c3bd685e6704ea938d1f470

  • SHA1

    84ab9f936d59b4837821ea59217286caf6466e11

  • SHA256

    1464b060a662f7629adb0bd7399a105e13fd6e8570180f7dc43636aad2b53c04

  • SHA512

    5c226b552b18e73549b52ffc0687c14e46038e13e4d7c74e18acb2f7e7cb5dbca3b81a46bbc4f5df2ad4f51d0bc53008bae1b4e34d8035a0229d6901a700ab87

  • SSDEEP

    12288:qwhuJDNjoEP/lfoHgjpuA3kIO8LayHHxhQvhzps7:xuJJ/oAoA3kN8eyHIs7

  Score

  10^/10

  formbookaxe3ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2