Extracted

• • Target

    94ade5dbc8785ceb3c54891a66c6c906fbe73d1fdd47922ac6de49561ef967a9.exe

  • Size

    611KB

  • MD5

    cf7fc3ae06a494c5659daa2a66971e8c

  • SHA1

    b4cb522e9da268a729e6e685557d45b8fba9e4c5

  • SHA256

    94ade5dbc8785ceb3c54891a66c6c906fbe73d1fdd47922ac6de49561ef967a9

  • SHA512

    d01e35f0b1e9074da9c1318f90d983624a4fc5c3c6343aa69cfe76b9605354b9361d84c6c27d116ca8b083ca6b044994d37d45deac37f9631ff3b4f45121db0d

  • SSDEEP

    12288:WxEd6SeObnbNfoY6XSLpy1AUngsREeSS99SFc4BK8kP84tqkK:Wxc3bbNfoYcSLp2AUn/FTSF9fc84v

  Score

  10^/10

  formbookpz08ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2