Extracted

• • Target
    9a18a413786aea5dd8b45003ba6510f2c1735d9c0d8f28e19bbcd5da17dffc3d.exe
  • Size 851KB
  • SHA256 9a18a413786aea5dd8b45003ba6510f2c1735d9c0d8f28e19bbcd5da17dffc3d
  • MD5 8cf0b1dce4214fe8f245612280b3312e
  • SHA1 79002eccec98b6aa4db529346d8cf38aacc0af4d
  • SHA512 4a3a303b85560987b3eb79e9a08c3cc9a40b74871b4d8f2d774176fbbd007ecbb1ad357d957f6be4cc39de05bf8cf2033195154f9636ac28b96c287a0b9009fb
  • SSDEEP 24576:o/thewlqB6p3QoNmmpdhNWeJKZXy3Qf4r8fmoVQQA:oe2q8pgoZLhNM9s5kmo
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookga94ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2