Extracted

• • Target
    SecuriteInfo.com.Win32.DropperX-gen.15494.12986.exe
  • Size 2.2MB
  • SHA256 78fff929b8912e1b4d90a3be2e07fde0c1f08d45f3682bb009eabca909183f44
  • MD5 74569507d8b35d6205695afa35524760
  • SHA1 42162ee52038c9acf98436e30de69d5f1f661d0b
  • SHA512 6476015db04f4e40e08b14bb4fec4b0437ead901de58e1c63083857b7cb0417b501d3a1e1bbbee23246aed9a2b7c6f287c4960d8877539eaedf6d02e16f237b9
  • SSDEEP 49152:MyMFQ4l+wfn8Q/V8zirsm19YbryF7yD+QI16AseU4:MxFQvC8bziM+QI16z
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookfs44ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2