Extracted

• • Target

    6f4246a44c4b69ed8cc30d0583be906c7a8040216321889da1bd74ba7815aedd.exe

  • Size

    864KB

  • MD5

    b98feb15976a8317f9edd750d3351f6c

  • SHA1

    e391a5fa6a96f0c1a69c4487be9c030f2bc40b72

  • SHA256

    6f4246a44c4b69ed8cc30d0583be906c7a8040216321889da1bd74ba7815aedd

  • SHA512

    edde72f26fab30e0aeb68ed0a2c681ce85cd3a3fe553b32adbb4b9748c0fe193a11315c7c2313ad58d268e5b4f1502c8bdcc36aeb1aed1c753c69eb9ee644136

  • SSDEEP

    12288:4Ht0TQJfrqsf88NSL7GrRybMVvC5mDPCegwjcsRvirNotqzR4FP8nKCVk8vBMHYJ:4trbfS7GrRyf5mb7jcgKaiE9dJlNm

  Score

  10^/10

  formbookn13eratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2