Extracted

• • Target

    SOA 5139076.exe

  • Size

    243KB

  • MD5

    928da2b69ca84f54fb68b4a0cdd6208a

  • SHA1

    2ddde07449e586d651a175d2c2d31da540d7a10e

  • SHA256

    ab72cb8573b9eac92ecf32c889a727552d386a5d31cb5daa249d430258e1e855

  • SHA512

    c65af359fdc5bc4024848b6195ef22c518cb7f27e7a15f412989cdfb94a7d936019aab56133912953a42dbd2f03fe5171d2f36fe7953e5969999ae5b8a932855

  • SSDEEP

    6144:rkwk9tOOQC41sjT5Oilk44pMeK/afoURzE9ThHGrniXH:kGwNOiNnmMdmu3

  Score

  10^/10

  formbookyurmpersistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2