Extracted

• • Target
    SecuriteInfo.com.Win32.PWSX-gen.21551.10154.exe
  • Size 629KB
  • SHA256 8859d68e69b5464a0100ca99aed26dec828ae92287ce09ce984db073c66e8e4e
  • MD5 eebb33a5375ffd40682c86deea752033
  • SHA1 8ed7b849ba2829a164ee569995f2d4d8a8d90924
  • SHA512 77b5fb3046040512a93e4e7069a5e4ded1362c2913b928232d00be416f93619c21e5a3aef20516336eb81e7c4067f88ae67caeada31ddda7480b0a5e3fcf5fe5
  • SSDEEP 12288:DK0YOwqVT+BnEymdHekIrOuPhKPrbgAoOxCzSb0c6gb/wM4IKkR:DqO7VDVdDIrOusrbZoGWy0c9wM4IJ
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookdz25ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2