Extracted

• • Target

    cd0f9f8e285dc698ec134a65cb519bf9

  • Size

    477KB

  • MD5

    cd0f9f8e285dc698ec134a65cb519bf9

  • SHA1

    8e1772b29b049782e2df7b81facca92428aaeda6

  • SHA256

    861da69934b91448a3336cb1202ede93466a5bea352da087a703823af581bc0c

  • SHA512

    ac55ef9b7e0c4482f1816cce77039ec43453172d12f96faaf6591114bfbbb4d68318e9f3b9c07ce44950b5a429d902e5cce49edcd4f510fa7545c6a210a4d76b

  • SSDEEP

    6144:+JzKf/zmCja4qQmQCrcbnFuuUcTFx0T21BOcCSaa1MSSB6T1KpQcHCbh3:+JY1ja4qQ+rcbFudkuN/S/1MSSPQcHK1

  Score

  10^/10

  formbookfrpersistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2