Extracted

• • Target
    d815c20f87e50b43e941bcdc45b158e5.exe
  • Size 374KB
  • SHA256 b757c82d494f1f23816a87fc609e8f5227fbe921aa80c5fcddd95fde653c8523
  • MD5 d815c20f87e50b43e941bcdc45b158e5
  • SHA1 65b9efbe3f2fba80a2c55c2f5f07aa0e852545d3
  • SHA512 ab36841af3b36a10e702e0a5b6c71a0641ab0f92d155bb51977223e8885b3aed001ed17514f3f9c58f0135b12d4fbd4620841ca2a4ddbdc1908991c9fa5438b1
  • SSDEEP 6144:MEa0N1T1wMMatrYfPJIGX8wNxVzZXDwUALxxYzwIIHChqzhFsrPDR591:Xp1GaCf7X8wNxFZXpAL/xEqzhwR5H
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookhenzratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2