Extracted

• • Target
    Purchase order.exe
  • Size 844KB
  • SHA256 f5a619550aab65a70f97f1128411ccd053444254ebb1df49d2d908c0e154d66b
  • MD5 7ed6256cb498f5a987aba753c51da2e8
  • SHA1 a34e2dc19b40abaff6572526a4432647fc99420f
  • SHA512 73f153ab884506394d14afdf142be5e759242cf6f852002ab7df3b7ee0c7249f50a963f57c973e95ee326304239ebb7576a2f8a6e6277451a17a736b002aa77b
  • SSDEEP 24576:N0DUY7TsfdHaoUR818CyPYBoi99yKe/s:SYisfp938XYoQ9yzU
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookij84ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2