Extracted

• • Target

    SWIFT MESAJI.exe

  • Size

    295KB

  • MD5

    6e61d20fbe58472cb648dd237d93292b

  • SHA1

    f380ad86dd042ed393a4be7ff311b9b2800bc60d

  • SHA256

    6067ef8eb25ca8f5d986b296550ed75294fd0f20fc795d23883f5884224632e4

  • SHA512

    99ceca2853e70c55b74309d31309075cf0ab9c05d4786dfb5827d7fcb2b35d45b3274fe28292b5c24712ef07ae9f0eea9d718ff16074d262fe6c81ce2ef69777

  • SSDEEP

    6144:lEa0Vp7O0FZ9d46iZ+D0iONVTqzLOvJK4rdOg:SzZ9dliZoNLOvJK4Ag

  Score

  10^/10

  formbooknf35ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Blocklisted process makes network request

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2