Extracted

• • Target
    2a4334476109d2ef5b95fbc6156e284a4c7340ffad00def833b23a3488884ded.exe
  • Size 541KB
  • SHA256 2a4334476109d2ef5b95fbc6156e284a4c7340ffad00def833b23a3488884ded
  • MD5 5e8a88b1e3036663c592a47cfb49e4f2
  • SHA1 b661c99c7be71d18887b15beeefdcff09668c044
  • SHA512 d7f85dba51c492dfac7fae800f6661fefcac1a1a73898a8c434168f167e26baa1bba9e86ee428a0f7a4d47c2d4a7920a1aff417c168c3c7ae7db6167a60a19cc
  • SSDEEP 12288:Hh77EyLu38MVW9xT242nEBWlgz7FD+PCHuw:NEyLuMvxQnEzFDHF
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookpf20ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2