Extracted

• • Target

    bb4e86fa92499e118e502b2e0bc81d0389048c678e2ce9b2ffef5c81f489eb05

  • Size

    913KB

  • MD5

    debe170f50f06aebab1d2f73f38c7e1c

  • SHA1

    4cb00e909a171eaf77e95ec8beace8940d9256bd

  • SHA256

    bb4e86fa92499e118e502b2e0bc81d0389048c678e2ce9b2ffef5c81f489eb05

  • SHA512

    f56cad6bb311fde24294f39450e0fe75a70c9cffbd6ac525b554e11006401b51b18fef1c686f78da32dc29207b5e315b97fdb1c03a7b2f4b2b19a4164438f390

  • SSDEEP

    24576:sb8FUqa9ywhtVZWKqINBKXJCPXgVOKPPPD:/5a9B/bqIi8/gAiPD

  Score

  10^/10

  formbookg2fgratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2