Extracted

• • Target
    a2534f954854e317c575b2b6009219c1f08994d1d5550e638acfa48f188da4ab.exe
  • Size 610KB
  • SHA256 a2534f954854e317c575b2b6009219c1f08994d1d5550e638acfa48f188da4ab
  • MD5 367f6008b54a00fd4632e2c9e1fc1d07
  • SHA1 4ffad187b30a3ba5fa545c26ee8ef33da8424665
  • SHA512 178730d067fd511a0ca9054d824fa32960ac08cdc062c114bff20d621b8683f52155db24909f76d78d27888aacc40d58001a64c3802e19b6de4620f8100a73c2
  • SSDEEP 12288:sxEd6Y8TDSR3LXMwvkZ66bltC4FmxzTjY2dmBrU2CdfLbh:sxcSD2JMJblUcmljY2dmNU2CpLbh
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookpz08ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2