Extracted

• • Target

    SecuriteInfo.com.Win32.PWSX-gen.8337.19865

  • Size

    1.0MB

  • MD5

    d895b9c76dd01f74ed7ac569214bd908

  • SHA1

    c4b0c3e114a9d31d7957f873ee0a87731fd16148

  • SHA256

    152d5ef19fdfabb482918d51148804bd5227e44e3eb5007dccc347b0ee8585d2

  • SHA512

    1a22d896206d1aa1dd40784ba7f2751687c0b1f148620f76b2484e1c105f831d290803cfe28554890ba1055da1eb7e6390cb684c031711cb5d065f0d63d35347

  • SSDEEP

    24576:FSfCp6q+gk0huWQks+28p9NpH6tvqrTlzqepF:FjJc9dks+2O9eVqV

  Score

  10^/10

  formbookci07ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2