Extracted

• • Target

    c411a390b1b6d2a1f0673c449aaffccc6dcc258b0a165d7e609ef163c4fb42fa

  • Size

    1.2MB

  • MD5

    37c143bd56ecfe511d90d06da76ade93

  • SHA1

    25078f86a10f251aad286ce81a7fcc72d3c28851

  • SHA256

    c411a390b1b6d2a1f0673c449aaffccc6dcc258b0a165d7e609ef163c4fb42fa

  • SHA512

    76bacf4078c5037520e65288973751e9d6ce9e05c96e3396f21e30cbec86b225d94e44e8d0df92d29e4b19aa8b9bf8dbcccef53d929903c21bd83414c200a4ac

  • SSDEEP

    24576:0mpkkZ7iYtU+wkxEbjw3I+g+qYsmj2BN:l6kZ7iYtEI3I+FWmj

  Score

  10^/10

  formbookdkaratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2