Extracted

• • Target

    b3938532376b8d895ba266de98386155798e984764ea778c43a842a3124ccfde.exe

  • Size

    839KB

  • MD5

    977c08465156ce304148addf3ded1f95

  • SHA1

    129c499bd4480a940c781c527b246bab9f5a5c8b

  • SHA256

    b3938532376b8d895ba266de98386155798e984764ea778c43a842a3124ccfde

  • SHA512

    853a20248c284f991027d3e88fde5d5c5831d9511d8e39017830d0eced1bc6d55c236ca0b6c20ce489beec03f7b05dec8d6457903a1438fce0b17d8c05cc2101

  • SSDEEP

    12288:eNhefaqG4yPaLrDYEVz4gqBGfLoRD+QqfR91lq6Fy2Mxzo3:ebeSqG4yPaLrDY/ELo1KJlq6F0xM

  Score

  10^/10

  formbookg2fgratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2