Extracted

• • Target

    srbgxywv96tp5kc.exe

  • Size

    661KB

  • MD5

    bc24bbabc84243feeaf0eb15d93ff488

  • SHA1

    d3a2c9d7d4c3178875b52f095f4283404fdc348d

  • SHA256

    e752c4ee3b2c0db6221f94f88acc85bb622b3c9dfd94614dd432d4785ad84cf3

  • SHA512

    0f3f2603af9368587fb6f30bb763e0cb2291ac4e651cd1a5d44fb17407d056a1fe90a7fce17e1032862d355a3768620ccb3951e83659b92c0fb8202d65a29d0e

  • SSDEEP

    12288:kPuYd+V6b1momPZefvB3bEZgN33pnxbB8Csck4U2E+z3SoVOdEIib9uaFskvQPuI:kPuYd+V6bIomxivNwZKnRsR8/CoMEBb4

  Score

  10^/10

  formbookfqwuratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2