Extracted

• • Target

    37572cb6f2bd3ef772a437f0e91cd813bfd270988f205c7a24f200ba4df6a609.exe

  • Size

    239KB

  • MD5

    61672650363565ad7ce71c5a261a5e7e

  • SHA1

    da70e0ed691217615c57963c58e18de927c13294

  • SHA256

    37572cb6f2bd3ef772a437f0e91cd813bfd270988f205c7a24f200ba4df6a609

  • SHA512

    17b7867c3329a1ccd514cb265622d9bcf8a817d29b49e7c9fd12e49ae905ef09683da32e41ed57054f0451b3fc7f562ad999c59558948659e63cfe17f23fc824

  • SSDEEP

    6144:QBn10ffIoo3VeRy65qQvT1GLwbTWYM89y7rOjPwA:gSR5qubqS96SD

  Score

  10^/10

  formbookn2hmratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Blocklisted process makes network request

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2