Extracted

• • Target
    ebaa46d302bc220922a76189a85e48f24587ccab47f674d37b02cf4e605c4755.exe
  • Size 827KB
  • SHA256 ebaa46d302bc220922a76189a85e48f24587ccab47f674d37b02cf4e605c4755
  • MD5 90e5f6824cb6ae31893827840db02e20
  • SHA1 c6f57e9420e13287ee33846e05efb07650182d67
  • SHA512 841da419218697d18d3e244c3f48b916437b1e96f5467b34285605ccd9d91ea0f0a36bdc9eb216e86cfa74723bae62b8c522a8c87da928f538421990882906a9
  • SSDEEP 12288:kJil52iNoOe42KMu/N3mWhQmwmJCMpUH7G5Wxo4AeL0TyL3sMdpPutKkmXFmhW:6if1mOV/NOaQa5WiTyIMd9dFXFmh
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbooko17iratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2