Extracted

• • Target

    338beb0d3fe9cf2946527108a44d24b8

  • Size

    601KB

  • MD5

    338beb0d3fe9cf2946527108a44d24b8

  • SHA1

    c2545a831bd37190ca8fe20e53346da6693a8d48

  • SHA256

    28dcfab7a0d5e305ef2c14bb3e0fc88d9fba7e38affd2a4fd89ab32c103add38

  • SHA512

    638d3d6d6a8c0ef9f97183c95aad8016ab791ea264a0717c86639c397eb4b90206893ec4d9ab43b18966cea771b614d604c3c9d8e7d1feb428f6657c31ae56a3

  • SSDEEP

    12288:gRmlQghT+BJnaHG72c1KRkswZIIQe8z94vd2:gwge6JcCsmIIWwk

  Score

  10^/10

  formbookelhbratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2