Extracted

• • Target

    RCY-ENG-SPA-44-22-SPARES.exe

  • Size

    566KB

  • MD5

    6a884bb90de45f882b333131a56b30d3

  • SHA1

    2bb5a01be489174666024a97573c4a725415ceef

  • SHA256

    4d19688eba48474ab160de7ebf85fa55f2f2fc50f678ce822f8ede4beaf427cc

  • SHA512

    e7ad8ad36ddd750efddb400c134d30dc90b47974860ea0248464245520aae67f4b14a94b980b43323051c0e84a9149ac760ae83b39c8ac0cac24eb1c2a7f8f24

  • SSDEEP

    12288:G1str70ixogYv28Q05rjBKS+r9AH0Ue2:Gir9ulvLLRwqH0P2

  Score

  10^/10

  formbookermrpersistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Adds policy Run key to start application

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2