Extracted

• • Target

    1bb68b89c42b3cc007dc9a7483688704

  • Size

    477KB

  • MD5

    1bb68b89c42b3cc007dc9a7483688704

  • SHA1

    4a348c738b52c8d61253d56609d8bfb7d83285b2

  • SHA256

    6d64eec407a209164b2ec1174ff79428506f0c47dacc2ca0b3698169b61e33dd

  • SHA512

    08243fd3d9d7cfbd132a11d195fa0cac1a81ef4b96da4e1a2c1e7c0b55fbbb1bcf16279f82457bf6f8320715d5cbfc554e306c76fa2ef8fc889bce747de5ec23

  • SSDEEP

    6144:eJzKf/zmCja4qQmQCrcbnFuuUcTFx0T21BOcCSaa1MSSB6T1KpQcHCbhS:eJY1ja4qQ+rcbFudkuN/S/1MSSPQcHKg

  Score

  10^/10

  formbookfrpersistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2