Extracted

• • Target
    HiU4VL9BMkwVhsG.exe
  • Size 975KB
  • SHA256 f1cb8bd9cdf78abe8ebb1fdffe785c8a681f3c984c5f06a77b7de74934c64aa3
  • MD5 bac08de138a8d2e74a66156c8d8b42f6
  • SHA1 30eed15de6a8f94d8dd557b7443edb70d8170a94
  • SHA512 f0058e11686cf72a761e575ec57e7b7f4cfec601a5edf864b1558903671dc1322feaa9aaaf08814a2decd21813b7c677503ca86c37b502775df88bce2e3ab2fd
  • SSDEEP 24576:oj2t7fueDyKQPSDQzFbri+FRYOUhTbkMgcM9FDUpsLEev:w2Jueejz4+FRwvkMgc052OEe
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookg44nratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2