Extracted

• • Target
    ba79f26ac9099e86e4ee3b045c484909.exe
  • Size 1.0MB
  • SHA256 0cf03f46e827627fc7cf3683f21e1da0f18d5a6e22e46f7aa4867aef4012b8e4
  • MD5 ba79f26ac9099e86e4ee3b045c484909
  • SHA1 3b991533e9a9fb044015e13265dc61028fd19d5f
  • SHA512 614f898159e4b29f89c142400a2dcffc8e044e0094055f9d36a9569d431b4a2306cbe69742c5b99dce19494f175b806ba03dab39cea55031d073a75dcb516caa
  • SSDEEP 24576:B4w4yZ1sQDNaCz9HFB6VBf2q+3y6BJQEcXNrYE:GUPaiuVBfm7Q1eE
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookg2fgratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2