Extracted

• • Target

    99c56c4551be01e229f63d5159d90f28c0b3fc18e7beae133aeea99a07f7feeb

  • Size

    225KB

  • MD5

    fc978e8e9d20edf8f2a0c4b157fe1920

  • SHA1

    85dee7df3f6c544117cde35c89d058856fa5f559

  • SHA256

    99c56c4551be01e229f63d5159d90f28c0b3fc18e7beae133aeea99a07f7feeb

  • SHA512

    a6796ffb98031e85d7916f40eca661e2bdc7f76b5f29bed8d818420a1a060acf801c965cc347181c81e5458e72751d4c7e464aa4dd2ba4f7f10ca3d13650ec25

  • SSDEEP

    6144:QBn14Fe6S294SbWAClQO5WkuJ9rkKwT/ZUyeok:g4Fe69IQO5+3krFw

  Score

  10^/10

  formbookhenzratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1