Extracted

• • Target

    tmp

  • Size

    829KB

  • MD5

    714adc41d77ffc1c073ea4f3d5828afa

  • SHA1

    a66bf6d42057d3a160da463aed3cfd6e415080b9

  • SHA256

    7845453819c89f24416bfa15744e3625fafb7544d5beb180f6fe02a4d639b227

  • SHA512

    1cdb32f0e96a4a2f0b7a86886625f2f489e9f2958f49f2874cb00730475c81c7621590e0ddc4e9f5cb6d575bf46d3a6f7278e14c823c06d58312f64747cbf506

  • SSDEEP

    12288:lD6qh8oeR7yYPpMCK2pnA7LO//Vn2mkXoej2S4GgJT9rlLFiNX4xWg:4qhsdyspMCAf6tTkClJ1SNXj

  Score

  10^/10

  formbookg2fgratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2