Extracted

• • Target
    Quotation.exe
  • Size 1.0MB
  • SHA256 628b6733b25f17bbb2fd8412fb6a2f507ee806bb695b93ceec593c8377d6bbb7
  • MD5 ed7c7be48fb96d950632142859ececcb
  • SHA1 f8f888596f6f841b0e7d8b34723aa48fac5eb37f
  • SHA512 65546254e00c882dc9f84618796d8f3a1b66721757602c1919c2ec03901e3d581c4a8e7681928d85d928b7b10e016b221acc4c57e6e7d68fd196008e6c85d12f
  • SSDEEP 12288:WFtPvcqttqb+YXDLs1dxk8iEwhuJ0zps72g8MhiXjkX9iBR5nTjsch5Ls7QJhUAn:+aydxkbuJEs77hiXK8R5TjsUNMu/HJ
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookoi05ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2