Extracted

• • Target
    d56e9061e7f6df6e094d1582d817c381f8ce9ac6c3925cba5da96464487a18b7.exe
  • Size 654KB
  • SHA256 d56e9061e7f6df6e094d1582d817c381f8ce9ac6c3925cba5da96464487a18b7
  • MD5 c77b45b902fb66b1bda25f0c9f32c152
  • SHA1 e17705713ede18731797bbfd7b5eb31a7ca52477
  • SHA512 61af84f112b704230a8f07ead38678e2e3052f55a86e8e7c8b480be2a0da03546801d03d328e663a6ba284ded71bba22bac3caf8365848b2e3e8abf8dfb2d348
  • SSDEEP 12288:Td4CMwtBBGV/8nu3JKhuL3RlcYgbXvApn76bUtaj6b0jZEgVzvF7B5P9ylA:FBJu3FLBlcYEXvApn76bJ3tEAzvNDP4
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookhy07ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2