Extracted

• • Target
    PO181219.exe
  • Size 466KB
  • SHA256 4cf3f2e4957d449f51f1a5dd6b20765aa7a1fe89231f1ea3748cd0c0e90d74c4
  • MD5 9f1c4ea29a9490e84c85ee622ebbee83
  • SHA1 03eb6bec9ca71f61726134e031ef1c96609c6fbf
  • SHA512 2eccd244877aae74692294905fa6d11e7b1d67d03c44147f59dddf1b6d6ffe849529bf1e0ccd1b142d5767c281e229053d6d5d513bcc3c0ec9b428a735ed5f97
  • SSDEEP 12288:jGNJ561IweViPtQjDMEnSHTigQWX+T/XRfoxwo4P:jGGy+t8kTEOY/4wo4
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookh332persistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2