Extracted

• • Target
    ET3B30WFvUox72P.exe
  • Size 853KB
  • SHA256 e121e41abc24cd4a27ec0537679a24a0c8ab76bacbb4e7d636fff4b775a89cbd
  • MD5 9c08d86c88ca7a12737a5a78f3a8ad22
  • SHA1 135bc56ea54a1133055e102a0febef4b796d06cf
  • SHA512 cd309209ee2577bce854784a1a0bbbf07a81ed22c768f8973d84e4e744e5e623d29d1b34580ec840313cd2713d8fb862fe460ff1953b96b4210a60cd56d8376c
  • SSDEEP 12288:70wOZQA6qectxWsQvktczPlDxheXw9lE2kSBcLUNfkg586aWHff:74ectxPyztDxheATPkwB5O8f
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookbmr1ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2