Extracted

• • Target

    MV TBN VESSEL-PARTICULARS.exe

  • Size

    277KB

  • MD5

    3e77705d1c4d75670cdb6221d07a2562

  • SHA1

    a7c0b6609f1740d02270d7c6f1ee9851a26642c3

  • SHA256

    4ec38c8028003269f3576dba1c4776266a9a8c4d26eb91e2148b1bc1a9994a7c

  • SHA512

    0a4bed3e39f2d753a970336801121dac4891b4956e4c5b93069d407f15191dbcfac0219b399de2aeaa60af298ad4c1803aa9fc8902cdb6985f5e7e08c39e8e19

  • SSDEEP

    6144:vaZ+bfg9FKfw7Jmv+e4uZk7/wA0mBJSrMQNrEA:vaZqgFMv+e4uZlmrXQP

  Score

  10^/10

  formbookermrpersistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2