Extracted

• • Target
    2a86cd3c0f52f11b0f3f89a6c9ee472a.exe
  • Size 659KB
  • SHA256 571890d2bedd6cc0cdf6cccc2e6fc4e19c7489adc30328c24d21e3631d24661e
  • MD5 2a86cd3c0f52f11b0f3f89a6c9ee472a
  • SHA1 674357cff08015d1afa76df35bb3c816a63ddf23
  • SHA512 3a59d607f0ea8560543dbaae46ccc9acb7037cd76773ba09ebf9ade48518e9b5c39221850383331c5af73a3849aff7bec2ce267d62f899201b9dc8dc1c3c6010
  • SSDEEP 12288:4kmMV7tcYuA0E+b/C8dEVprsqXe7QwaoXwn+8KBwp1NcXzXafp:Rm0KAoCVprZXe7qognOb
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookmf6wratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2