Extracted

• • Target
    359834dcc2af3dcbdccb1c13f186c74179a998fe02cbc02afce017c69f717351.exe
  • Size 694KB
  • SHA256 359834dcc2af3dcbdccb1c13f186c74179a998fe02cbc02afce017c69f717351
  • MD5 d1590c9f8838d546a8bb573d0269c224
  • SHA1 7fddd16d3c7b8aa66605b47f52db8f3e4544112b
  • SHA512 3591ea67c0d80673794a338649b5575aa16f4e8984793b73d4ce1db40b4e2a740a7409868a9414f88251f17c7774e0f772bea2dbd57517be6a1cfcff9c25e203
  • SSDEEP 12288:S3jOfbOdeh8V/J2xJXU8fmFKGv1K/XWFhTeKbrI37RQpMdooxl:gd7T2XzuKc1EmFjb03lQudoQ
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookwd23ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2