Extracted

• • Target

    ef0ceab01e813f995915d6c596bd663a469928024e9295b093388a4a7215bb1d

  • Size

    694KB

  • MD5

    c4523a20a3e46acad92e1cb38adc378b

  • SHA1

    3f239f11ee2a8728cc65266111abbf64b1f8dc53

  • SHA256

    ef0ceab01e813f995915d6c596bd663a469928024e9295b093388a4a7215bb1d

  • SHA512

    4b0c6c0615b8c16583e21e7b68ec5c38e0f5ac1f480f3308d5734ce598836a2e27a80e2959458690ee9dcd7544ece9fad7e23b6c0356784524d6e0e439b4162b

  • SSDEEP

    6144:rEa0dpkNz07AFqV57lNO4/mq3kl9SK5WO+Dg/Fb5aHDiTBfA+RhdUx9:Y57lNPmikl9SK5WAHkDiT5AshOf

  Score

  10^/10

  formbook54utratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1