Extracted

• • Target

    MalwareBazaar.30

  • Size

    483KB

  • MD5

    fd65054f56f7077c515ad94d82d63392

  • SHA1

    63a48e65af8911d5aeacc86b56775a27ae4b48f6

  • SHA256

    19fef236cdf3c97076fe4dae603f81e836e2aa3ce93865a328b7cd44e560bee7

  • SHA512

    06b96741242ec89b09ece150613257430a6463c769e956fb4f9cd4d5fa36970c5f06b7faaca18c702b92d08a65a1a787057c8b73f2059c9949068ba3cc41e6e3

  • SSDEEP

    6144:CIFhuSYWFYgrKsUc3y2WnO1xzcWmZXe2rkwnbo60T21BOcCSrYDEgfje5ig1ef9x:Ph8Mz+sv3y2N1xzAZprkmuN/SD5iKefT

  Score

  10^/10

  formbookowdiscoverypersistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2