Extracted

• • Target

    c5eb2e141e2889e82b551dc4804f872a59a5846aae7c4419409fd13fb94f3deb

  • Size

    287KB

  • MD5

    f8c0137e86efffc94ec95f659eec812b

  • SHA1

    fddb98b0392fe58f543ad6fd80063f9bb56288dc

  • SHA256

    c5eb2e141e2889e82b551dc4804f872a59a5846aae7c4419409fd13fb94f3deb

  • SHA512

    490d3fa13e51a7ec98db96d8de9814a640820432f47c70d2c4fe1d9b1355143628f841ebbda70f8a43c070e1fe6a7093b9ea170a9ed912e02ec02d513275ecc8

  • SSDEEP

    6144:HNeZmH94iQoLW7RdTmkhXj14ZsUTKkP+Lt:HNlHQkiRd5juZpGQs

  Score

  10^/10

  formbooktsuzratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2