Extracted

• • Target

    4b9fed291230a554fb3885d1e3289111

  • Size

    601KB

  • MD5

    4b9fed291230a554fb3885d1e3289111

  • SHA1

    5e0ca8ed4ceb45cbae58837ba95219fbb4c00ee2

  • SHA256

    afbdeed783327858a21dbd66af203bcde4415828557de7ec0615ec177b198ccb

  • SHA512

    a32d7bf227a4d51bc636a21b7095dd7e601943a438ffdea2510371b79df7555f5fd0c90b9c0fb95aa396fffd5e34c4f6680415f29b6f342ac944a6e73ad11444

  • SSDEEP

    12288:gQn76IMYGJq57woDY9GE68UPB/Gf+b+PNT0yonFZ4:gQn76RQ7vERUPB+WylGnF2

  Score

  10^/10

  formbookelhbratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Blocklisted process makes network request

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2