Extracted

• • Target

    25a6280b20b14dc747c700a1a91cb51b.exe

  • Size

    537KB

  • MD5

    25a6280b20b14dc747c700a1a91cb51b

  • SHA1

    d6afd68cca616d505ac13532c008c328f225947d

  • SHA256

    c81c9ba400d187e3f9ddbc3c9b31a5ac9ae2d102969a30d0896b19efd1981ceb

  • SHA512

    06d636b0af2452865962004599dc3de9aa1a86c5ac058ba166dd27d68fcecde522a1d57f2faf8dae488d77686dcb7a0335ada5faa14fde82d7aa4d70c1831c8e

  • SSDEEP

    12288:JPComBcpx1XTaASnOXo3aqhgXMQhbqCEPUwfqzbXKxySLJpcnZlmYH7J:4omB6RNhRqC3RHqDcnZ3l

  Score

  10^/10

  formbookfgh2ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2