Extracted

• • Target

    60822680920de27aed07c2352.exe

  • Size

    594KB

  • MD5

    60822680920de27aed07c2352674f05c

  • SHA1

    4d250b0dcf899a48ea668343fef7e724c58fc6a3

  • SHA256

    cbdd01f3d5cf0da163dffcfeb7ac99de37e94c2b3467630dd4b09ac64bd286ca

  • SHA512

    3ff5d5231a7321abc742afb28f713bb2d4486361aa8be33a39b4f3b13700ba40b174aba63bf1c7dc9187aa37a585d815fe0fedf3d3bbaedeffa4f6e7646cf3a4

  • SSDEEP

    12288:QmlBwdW5vk/j4it8ygmgLotNhzT4j2vwvYRTf6/AP1ckphDX:T6dW58/DtMLotr06ovi1ckphr

  Score

  10^/10

  formbookmf6wratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2