Extracted

• • Target
    8ba02b03bb01ec961fdb0b1a5dbd49f1.exe
  • Size 690KB
  • SHA256 67cc4306421a289d79bfd855c3da5e7ccbfe55e8eef44fc6c48aea748848ea5b
  • MD5 8ba02b03bb01ec961fdb0b1a5dbd49f1
  • SHA1 0264ff8e36f69f5a78e417dfe38b48e68c99383b
  • SHA512 09721d0acabd344fb0313cbb3ca2a2f5a76fe7b6ae4c308f4666dea8cbc192984562183f81e8cedbf7da8468db37516bec5d3085579ce11fab73e73d376be0cd
  • SSDEEP 12288:LZuOwJq+5HcYVvQ7A+gYAEBqDGY+UND4IjMxS02Weh3ih9H1A:8Ocllc9AXYRCND4IjMxS02BYTe
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookg2fgratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2