Extracted

• • Target
    0f4185aed646dcc354f61968b69d25e06fdb3fe3e6bab9b52e2ecce1395f667f.exe
  • Size 826KB
  • SHA256 0f4185aed646dcc354f61968b69d25e06fdb3fe3e6bab9b52e2ecce1395f667f
  • MD5 091a4086a4393d7450f36fb66fb92d31
  • SHA1 b75d2ed9f8bdec6d84ce427185ad6d8037eac12e
  • SHA512 f86931483342ac2ebcdcb01d2f0b0b6eee2a96ff3bc440069e8467cf388a6cca7a458ee5fd5e23745b4a8412f4d8d2539334312cc681bc7326115a98604a2968
  • SSDEEP 12288:9KA5G8cPtP8sdE0rm1OkKCJLc/Y9ysnqY0FsgtK+CVINUX9yKBg7vjwv8x:9J8P8sVrKOkrggWFsgoia9yKe/Dx
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookij84ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2