Extracted

• • Target

    SecuriteInfo.com.Win32.PWSX-gen.30247.2423

  • Size

    550KB

  • MD5

    5adbfe3a05eb61b2d2620b6538dc5772

  • SHA1

    8bee7a099e2c1753a62be196915da3756758e75c

  • SHA256

    d404e5865cddbf47f6a494f9120130035b3ac5761810dc75e20bc28873327547

  • SHA512

    5d66a876e199a1733c9c445cdb5d2c4d4842373a710c6a93c088d1d5456ef7c6a3308a56b1b00c5852457ec8db8108b1fe278f45b0dcc7b7433ea20b9e4a465c

  • SSDEEP

    12288:JZ725ZbHWLBajVyuexPgAHsP3o4roF6Btp3P:uCQSxPgAIogPBth

  Score

  10^/10

  formbookey16ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2