Extracted

• • Target
    Request For Steel Tubes.exe
  • Size 765KB
  • SHA256 e12e92ded58d05cf87a0cdf4323859145f5aa09da69e4dd3ab622e65a9888587
  • MD5 a976251dade5457ac4335138e63a6551
  • SHA1 ffa7dce8c52d239d4fcd6dad4d3ad88428733ccf
  • SHA512 96a51c9a97fe2117eb7a451256082b510707c4f43502ef617179073b26586b2303c9f636d4025334449e20649f43f3c888c03151f141b5cc9c0303e3e42d41fa
  • SSDEEP 12288:Efx2kYjeAM/l9zmLQwDUCq6iLLxk7QVz1jA3hnOrgcZXJQS76K:XDjW0Ud1LL2KjAx5c3r
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookoi05ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2