Extracted

• • Target
    ENQUIRY SO NO - 270.exe
  • Size 1.1MB
  • SHA256 7ce7ca5deeb35f3cce19ca4e01e28aebe9f1b03dc8778a2e85e0d515a6df1a3e
  • MD5 e9ad14c57de3288fd9de4d5cdcbf66e0
  • SHA1 c21ec1560b66e3e4581a8c6cb41fa769527cfd7a
  • SHA512 61199ba16efbe0036e909a05b46ce41a36b019bc6af9cdd8c39bde1ff595d0309bbaca766820c9bfef9d221d3bc850cd5f7e42729fc43a1d5d6a1fb6c8236ba5
  • SSDEEP 24576:e0pUTyvWX1Qf+cBX0RxfAx5lv2s6MDYTbJNkj:TUT3XTcR0zIBv2lMDYTbJNM
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookoi05ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2