Extracted

• • Target

    КОММЕРЧЕСКИЙ ПОСТАВЩИК.exe

  • Size

    646KB

  • MD5

    a48a58a847addb1ee3568eabf32b1b9d

  • SHA1

    6bbeec62a240953cffc1a084ea59141a1368600a

  • SHA256

    7b9502c277114c4c5cde1d0ce893041f2a880ce2808855ec74faf47485660d51

  • SHA512

    78cd13f36a0b61bfd4f13401673efd071a6d80da9d27e8988179063182a73a42645a35b1daf30d89856b633a8984172a41dddbcbe884afd2f6626fb16790d19e

  • SSDEEP

    12288:D7Ob4wOCsw0POWu11FDLB3yT+rPbVvYmh20XchGycysYUs1uE5z12H:DGOCsNuJN/z5vYmh2Cc

  Score

  10^/10

  formbookgy14ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2