Extracted

• • Target
    OOuMU2rNA6e7trM.exe
  • Size 837KB
  • SHA256 2106aa8235bc1e05d367bae1e65c50bf8d11c4b4106ceebde0f9307ffcf273c0
  • MD5 b185ab1a2b4309a489c658d5231c3ce8
  • SHA1 9e09ef7b618d841ba4fc0cc17d0a76a24acde115
  • SHA512 bd15bc8fbbe262e1831b82841992409a8f9667b209fc9bbf257677b74833a71586ca3d516046f29f656709ef9ae822b6998dcb18cdc80de4630776406b9d1c8e
  • SSDEEP 12288:9cNhQ3udD6w4toeYw1Ctn4Na7dBNBNjma3gKZ/nXt7virmWhlGLaQYI:WNhHZ6wG7Yw1Ctn4NCF
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookbmr1ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2