Extracted

• • Target

    2ee6aac96667a49df963edc8384038b0859d689ab4377e74ac7f45086010c732.exe

  • Size

    749KB

  • MD5

    6561c71692329e5c4b10948e273ac496

  • SHA1

    f01d729fbd8934730fd7531fa00649089e531616

  • SHA256

    2ee6aac96667a49df963edc8384038b0859d689ab4377e74ac7f45086010c732

  • SHA512

    73fe44ecf169bf6b35b7b3732caf201a6d949739cd5b627137f63dfef68e20ee9132def26672ecd9689a636d269a3e14853b6d771312c764ef23b2a05f762fa5

  • SSDEEP

    12288:i97mYMUnFW/N5b9hsF+U5u0RX4up4Aev8lZLse1bdHnL+2CzomKsciaicxJnj:i97UrIF+UloE4AevUZhniZzL2iKv

  Score

  10^/10

  formbookjr22ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2