Extracted

• • Target

    30571d64c9a9ed267159fa941a20840c

  • Size

    272KB

  • MD5

    30571d64c9a9ed267159fa941a20840c

  • SHA1

    bfb81d8a7c94781b3bd939bd17d500ae61b2ff70

  • SHA256

    85d6c9eac93fb8818d37dc15110ebd060b3e9df48043ee6bcf349df6aed047c5

  • SHA512

    5c8b708f3540b9347c36722934c8fc56098a94f8362688a8fa712da99e1b8c2564698eb0bed52e226cdfc40cf8b762e1860f6ea9928260e3f0f35bba9cfda82f

  • SSDEEP

    6144:QBn10/UR088uiPuDtJWn42Isu/20+kfAZLrYdwMPTnDMiQH7oPo9:gWLuiPh4rZOH5ZL/MLn4REo9

  Score

  10^/10

  formbookhenzratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2