Extracted

• • Target

    tmp

  • Size

    2.1MB

  • MD5

    dc86d8c67a66d23d6cba86036dacd475

  • SHA1

    3c803edc8f87f3c69c460ccf1255ed8c9c1651f6

  • SHA256

    a8d97304d740bb44b27e40303d72326a34d30973e801161f4bf026fff552c1a8

  • SHA512

    941b380f3c393ebb776b0d181b290550b528534f50b6bb55ada418f3639d8ccd07587303a7b680937c0b641e838cc2f98265d93f56d7bbcd9419e7a2512a69f3

  • SSDEEP

    24576:MuOolI+AqJiMqbPf8/cEnn8jrO+jfn2QaRgRBmjb+Ba56r19EvAI3eQFZ:x3Aq0U/cbjjL2Q+gRBKyq6r19mAI3RF

  Score

  10^/10

  formbookdo25persistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2