Extracted

• • Target

    ddec6968806b89640eed8ad10d3f33e1cdf0c5a9f596e128d9f3fbcecfad5fbd.exe

  • Size

    740KB

  • MD5

    a33d9b8d1cf40a7d3bd2601917276ed4

  • SHA1

    4fcf9b739705cdc9dd1643c152df2a1db4ae2e48

  • SHA256

    ddec6968806b89640eed8ad10d3f33e1cdf0c5a9f596e128d9f3fbcecfad5fbd

  • SHA512

    0d8870bfcee2d68eff506ae507f9e20b25dc9ec4eb54d8212dc8743a8e443b26cded51e9e845777d2f124d86ca26495694553e05872a6668fdd2dff634cd4892

  • SSDEEP

    12288:kwl+momPZefiPtqvyu1JtnN8t2iZX65arc2+dTbt1NbXBFHWf0Tg90/G:romxiiQF1fN88iZX65S+t1NzBRWeaoG

  Score

  10^/10

  formbookoi05ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2