Extracted

• • Target

    Confirmation transfer Ref No_0033463247892.exe

  • Size

    890KB

  • MD5

    03c738a9106a7ba9bad7f4995d52f028

  • SHA1

    204762dbb01579ea39295660d86085591578e0a1

  • SHA256

    aa6874a63646474141e2928b094c5dc15a1fc2ea610ece7ca7f95b80ec856be5

  • SHA512

    d87e427aa177cd28b989e00a4bb382679054009a55021834319ee78bcc181b91d72b639c78fceb7e89584aef552af2fbb7cd90ec76719fb8cc81b18acf4e8c8d

  • SSDEEP

    24576:jmRx3Gdhk0yClxNwArBMQm8i9eXiDdEPf:jmr32hkGFxBlmFezP

  Score

  10^/10

  formbookq4k5ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2