Extracted

• • Target
    9494431449041366a97d15e2f88cc8aa.exe
  • Size 745KB
  • SHA256 4baa8f661ea6d1777e87005c1a5c2a73aae516037084f6318d3a13528f3a812a
  • MD5 9494431449041366a97d15e2f88cc8aa
  • SHA1 9ca0d894243bc5eff36b6430729bd158f1557674
  • SHA512 6fe62fd8b6634ef902e29a5dde51257e44dcd9c1faac0bd0cc586bc7e19a6d637fb2e4b12071b3a9c3678737bf4e28bf1e8d70cc4ec55ed6dd5a4697593e46fc
  • SSDEEP 12288:9HJ4aGp7tL+NlMp2y0V2az2Z1XdcbfMcM2hH9nNq7BczAjsUf4uw0yP:Ep5R+2U2Sgb2B9otcuFw0yP
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbook4hc5ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2