Extracted

• • Target

    5b0ad70962c30c5d8121d9952c0115449253afc64eee634b73ef544692d1dddf.exe

  • Size

    344KB

  • MD5

    4c81a87e0db78ea6a775bef1503d6ec0

  • SHA1

    e11930e6e07c9c17aaa53512a28e63859545f486

  • SHA256

    5b0ad70962c30c5d8121d9952c0115449253afc64eee634b73ef544692d1dddf

  • SHA512

    66001fddb953d6bd178b780e23ccc0ac4f94b4c4157f028995d5b3e0c548982fcb285ec1968cb75a11d838494b34df431b6d7f9d63d7d50d17e42b40e85a184a

  • SSDEEP

    6144:QBn1ARf0fEEreo2gSo66il6s6DZBvNhMwALYT5Eme/OqZbklOExYi6UZS/P:gAx4EECb3oCH6NBBoSA/OeQ/xK28P

  Score

  10^/10

  formbooksdq4ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2