Extracted

• • Target
    X4Tu5IWZiaomy5r.exe
  • Size 680KB
  • SHA256 b61654d4440ff18d10ad8a7425493946063c79e233aef6e97d8b6c20d092bda2
  • MD5 61fd0b434aea06bc1d0a9d2e9cae9a93
  • SHA1 df2261c450ef882338e09310c7d3b3b21d76479a
  • SHA512 69f5959a509808e7c322c89dbf2fac26bcb1834a65aa88a5e1eb75b1da6603317b4aaa6c40060d91da985e4917fad8973942ab3cded0d6cbb766028f5c889115
  • SSDEEP 12288:siaSUk7IoMR0t+5w8TWnRHpJnVgM0Hc5h5hivTsM5oRjQx3:siaSUijjfU4RHdhSc5his4QE
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookft63ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2