Extracted

• • Target

    cf722cadc5cd807f450ecd57785c49a4bd1909970bb883adaccadffbe945cb30.exe

  • Size

    640KB

  • MD5

    dfd0f762fd0542dfb8c6155cff5c4e3c

  • SHA1

    733846f769a61f774e786846c3c5da51250dbc90

  • SHA256

    cf722cadc5cd807f450ecd57785c49a4bd1909970bb883adaccadffbe945cb30

  • SHA512

    bcde62426af18f3180f3ea31d14567520879e0128d4beda092b2a920d022296c42bd9c4b7e2ba788fc940e5c4abf59acf39e5ef22b2bc466a7e59c471a4d87ab

  • SSDEEP

    12288:3/ScVvTEazpgOSN2WURS4EDUugrUuU2couM84IgpFrggaIJf9npIe:vSOFzpgOPP6OdUVZP9s2IJlnX

  Score

  10^/10

  formbookpz08ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2