Extracted

• • Target
    Request For Quotation.exe
  • Size 663KB
  • SHA256 cf241bb419e3f76e1de76514e4c015b2afd1ddcdfa52ae158717e78f7090e014
  • MD5 5c9b780ba7e4b19274c5cdb9afccfbf3
  • SHA1 e3ab3e0e3e41d37cd715e8f2c9a3d03d4cb58a9f
  • SHA512 e02e4f3766dd02cec20b9eec926156e8da70adfa02996c20e68d228b1da0ac98fab848c1cb10499fa93e1122a2c6f0242a2af50e9fac9382cae7191b93e52eba
  • SSDEEP 12288:PhB/U/5s5B82ko/ZMWUn8cdTrfY/IUXNzsENs4cjZnbCkI:Zu/58ko/ZYnNdTbYQUXNQ7hjZnbCkI
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookoi05ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2