Extracted

• • Target

    19f731a9fd9077633063590007ede514549eab529ea3b4d0c4f67c3efd861417

  • Size

    696KB

  • MD5

    0a3090e1388dd1d864c61ce2da00e9ad

  • SHA1

    0d5c2bc5f9dee93582c0f44284b7de83d2fb7724

  • SHA256

    19f731a9fd9077633063590007ede514549eab529ea3b4d0c4f67c3efd861417

  • SHA512

    0711a80fd227cff79ea5cdf783c7c2f6a18ac15d7d326a058724d247ef2ff9bd9fb72d2bc1174acb6e1f9f58093baec0b00b0602ade4d792de77e5e362fca023

  • SSDEEP

    12288:H/Hvgh/PsZ1DX/VDJGBtNvY3jvhnAXO8kL/BRVSIXt1yffSyB30:Hfvgh/P9Z+jpnQOD/TzPWfSyy

  Score

  10^/10

  formbookd0a7ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2