Extracted

• • Target

    22d3aa3de84b7d01eccdf2471c93da8cbdbf39afc3a1c149d2109f2f9644f5d7

  • Size

    225KB

  • MD5

    f0a448d757645c4c8159d946be6cd741

  • SHA1

    b91620ad9a0f0363bc2c1c853af4012966491706

  • SHA256

    22d3aa3de84b7d01eccdf2471c93da8cbdbf39afc3a1c149d2109f2f9644f5d7

  • SHA512

    0f02d99b5338c5869db540930f5b702a752ee7aa0ee3566f334c84783ce9bdd3c956f9f0073e4d11be7bd3e02c0b228c1761b9ee319f3739bcbdc8fd78d8163a

  • SSDEEP

    3072:QEhKzShSycSMymlNbHD6OwfyAET17nwrmPRTFdyEOTwkBu8eg8HCRtFT+uwptnS2:QBn1yo5DXwfyA87nE04MEu6+uwXnp8Xm

  Score

  10^/10

  formbookhenzratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1