Extracted

• • Target

    856e9dc2812c572a9023f02503c471addbf8a82be5aed8454cc6254f899caccb.exe

  • Size

    332KB

  • MD5

    0a3a7cba003467f2d1976ba842d155dc

  • SHA1

    76327dbc584a204335aa840cf2ecf1d956459ed8

  • SHA256

    856e9dc2812c572a9023f02503c471addbf8a82be5aed8454cc6254f899caccb

  • SHA512

    9fca4b455b0b3e911222a3da1c6c2e15bd4042d6c0a9860fae4e173cec81f8c6a97e05ba4fd7f64f012a8c49d4c440aac7a749ad244f1b8e64c5eb1e1a06a5d6

  • SSDEEP

    6144:9kwvbmtv3a9uj5joIvbmcZwd4535p3pkRC9XrtDgwLKTqSVN3DhMggWnC:7qtPaQNjjZc453Lp0KXpfLK+SVN3tHLC

  Score

  10^/10

  formbookhenzratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2