Extracted

• • Target

    8c86c2c68e14eef2ac6a63da35633b309ef75e7f818a6bf935e56471ed5dae53

  • Size

    384KB

  • MD5

    ea0406dc2d0cfd68f8620e462406a819

  • SHA1

    aca8beb5b8055efb907e600f0ac51160aee5a548

  • SHA256

    8c86c2c68e14eef2ac6a63da35633b309ef75e7f818a6bf935e56471ed5dae53

  • SHA512

    34c8d16d7a1e54d81eec84c4b4e9bb3b11388bf97317b6d1d0eb396534497c6d490fd43f75c83fde87b7d8aac307fa98b874686a4d42273e20a708f1cc8b24aa

  • SSDEEP

    6144:jYa6yIgee0WsmHcrkflbDpIHTsxLB047a/wlz9POTaZX7UWzkaJqxB:jY1gAFmHc6YgHh7a+pOmX7UyI

  Score

  10^/10

  formbookdcn0ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1