Extracted

• • Target
    SecuriteInfo.com.Win32.RATX-gen.10492.22050.exe
  • Size 660KB
  • SHA256 6d0e5a8281bc43ebed5226a07a5e5e065c2f820e07646fc01273d7ec16689c88
  • MD5 d62f501f11a35876ddab67799917cf94
  • SHA1 63e3e65c14562be88f12ea2a100f993082d65747
  • SHA512 6165f4cbe82a1d94ccbb41af718796ef380b225cc9777c8b7f727b40452c3689f721886e5aa3492bdfcbbebacdce692a89dc9ec8541d6ceb97eb938dc5ca1b1c
  • SSDEEP 12288:KOnu0b+NoexY/Wyb8l0rd+X3GBvigdqWLRlfIHLjoneCY7keoSrwvTl:KO3+NNx8vb8l0r8X38vigAWLR+HLceCx
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookf9r5ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2