Extracted

• • Target
    9dad6e1350810eaee247d225c134a39441f286907c861fd6c825656cc9224613.exe
  • Size 816KB
  • SHA256 9dad6e1350810eaee247d225c134a39441f286907c861fd6c825656cc9224613
  • MD5 240f134e5318c9efc8f4edb219a9b16f
  • SHA1 7150a57a5817c1602524fc2b3b8dfc2910b77148
  • SHA512 704090e6007ae618f397d86ec1c7ffd8b2152cb2dfcbe6813a4d04963f07805ff7fd7f3ae4bdf99477f0791c31ede7609f59265a803893c7c89f07b62841f581
  • SSDEEP 12288:JYuePwisfcgWf/j5VtK+CVINMX9yKBg7vj1UJ:2uIydk/jPoi+9yKe/1U
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookij84ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2