Extracted

• • Target

    27d5822dd4cdeafc49c43ccbb21ce23d954880fe396902ce9e5b5dac81a6cf84

  • Size

    7KB

  • MD5

    af5bbd736013f8528a3bd005472d32e4

  • SHA1

    0a3445d75d92ee7b1b9e76d22ac72f775f2481f9

  • SHA256

    27d5822dd4cdeafc49c43ccbb21ce23d954880fe396902ce9e5b5dac81a6cf84

  • SHA512

    ce2e34520912ce40285598776adb55fd34c3882903ce3722728556070036144d492599147b84dac03267501a4d919219260fc16026da0cc6503859234c071320

  • SSDEEP

    96:YICxjg4TvWzBuUPhsMYJCMuH7q+rDPfkHHJkZjTA3GnUODL:YfUuUPhhdbqASHa5Av0

  Score

  10^/10

  formbookdv22ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1