Extracted

• • Target

    96deb2b04135c0b3d7f7ad059870a3fb2e8aebcf8c260df81f507d8fbe71fb5c.exe

  • Size

    619KB

  • MD5

    505a7bbd2a5d99eec94ce25041edbb56

  • SHA1

    f606ddb96230530ccf07aa12b3ff0532e26272c4

  • SHA256

    96deb2b04135c0b3d7f7ad059870a3fb2e8aebcf8c260df81f507d8fbe71fb5c

  • SHA512

    09a932ee81673f6663ab3354793a062ba58823146dc2db7149cb72e687b692327763797f5046af260b8b5ef9f3345ed2e2d1331f5100354cdb63c26a9cf553a5

  • SSDEEP

    12288:r85Ujd53LlvtekDu/JLW0WX1ZuiSFYHFKRC8677FOBM679:r0KXlSRWlXPuihFKRC/77F2M6p

  Score

  10^/10

  formbookki21ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2