Extracted

• • Target

    SecuriteInfo.com.Trojan.Mardom.MN.10.23111.3388.exe

  • Size

    1.1MB

  • MD5

    3c21079c403687f4339a136919931ef5

  • SHA1

    05bb1260bbdc0d05460f41e2423691f7c044bbe9

  • SHA256

    2088000ab7a60b6d9eb519d1da9d42934e908a9724ab6977bc853d30b7f96642

  • SHA512

    1285f2e9b1fb1cf2785f88514542a8bf7beeed52558fa9fb49280e2c91b1e17ccfc514435969491cbd0cd0d4f9d29e7803eec248ca43e04ebf37d5f14d05bc38

  • SSDEEP

    24576:LNlitFN9lSz5iPqjiX+Iv3GytN1YeZo82E+u6Sz73JEL:LvizNCzc2I/GYNj6zup5E

  Score

  10^/10

  formbooku6hupersistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2