Extracted

• • Target
    6d1fc60576f650b2806d7e74da8ddd79.exe
  • Size 316KB
  • SHA256 e4b98a029783ce068a262f3393caa28754470082b6b7066f34a27595e5ff2ea2
  • MD5 6d1fc60576f650b2806d7e74da8ddd79
  • SHA1 e315d5c0868e4a2c8a796e52616cc71fe02f2e4c
  • SHA512 5e6cb4636df3121435c16d509a717965cdde9823d67876b75217b8346c4de1f5aa37f84eab951db6d5ff1c4ba68954a63a8556c8d872d960705cab759baf2c64
  • SSDEEP 6144:0Ea0Mr7/9GTiV71Oz7VtsorLQMYN6amP+73M/3Qt9/FvDxxf1lB97Z0V5l3g/Gjh:mr7/9UiV716rLQTNmP+73BpFvDxxdjIZ
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookg2dcratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2