Extracted

• • Target

    b85bcfc355d32617c12a2e71d4f80880.exe

  • Size

    271KB

  • MD5

    b85bcfc355d32617c12a2e71d4f80880

  • SHA1

    8f5e2fcc9006bdbdcab9b6e15893b781fb893775

  • SHA256

    b9f158fac329391c893814424e77c4f9fc0460026b93327d8cf35598a561a1de

  • SHA512

    90874f7c64abd954ec34b4152dee1562cb55af65916e854dcf9c52f4be0270ff71c3fe57f0466f7dc18ce49c5cface4b5818df355a847bba5a4c982721b56bd5

  • SSDEEP

    6144:QBn1vvXZCzNhTIyD2bE8Nf7B0AxHklinnqPazURP3gawRwcV:gv+m/NDB0AxHklinnqPai3gdScV

  Score

  10^/10

  formbookf4caratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Blocklisted process makes network request

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2