Extracted

• • Target

    12a921f6abb929d4f8b28924868dcc468299e44745c37db3aa7e4ac9bfe38869

  • Size

    334KB

  • MD5

    2b087c00777a630a4100c122f4687783

  • SHA1

    618f5bf8bea9d2c431c4389c18e2dd91082a0d67

  • SHA256

    12a921f6abb929d4f8b28924868dcc468299e44745c37db3aa7e4ac9bfe38869

  • SHA512

    cb47508cf530de56e1c2317351eca84b832d431a516c4da2676855e6d76fc6d06b4b328d4c7ece2ff7ccc54acf04644a1f30e4e8b8067dc9889f4a7a32eaa37b

  • SSDEEP

    6144:QBn1W74u851+xu+La/EZ4sAR7Im/VvQgUJ5IBjiIQ1XhXXMaXTEZ2iaH4hY:gW7OgxLLaE2R7IwY5MjinzEoPHKY

  Score

  10^/10

  formbookhenzratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1