Extracted

• • Target
    LF20240228.exe
  • Size 652KB
  • SHA256 3bd968f2cff76757eb1bf75e19e8302ef97417c65ce9c0accf578eafae435c6a
  • MD5 26a38af05a6bdd23f047eb65fee67251
  • SHA1 61633e621f7d7cdcca5936b27a18cfe7e5169aae
  • SHA512 7d852f05e4377b77691c3c7517609b6bd12c96d0c5dfe0bb330974ff891731529c12da9a7d52ea0f4e526fd35ce35237bfe40d2099afc12f59e58f95157e16b9
  • SSDEEP 12288:JCTYHa5WHBh2Izs6vHhIlvyuq7it546mz2p9:QTYNHU6vHKlvU7ij46mKp
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookhy07ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2