Extracted

• • Target
    MalwareBazaar.30
  • Size 483KB
  • SHA256 19fef236cdf3c97076fe4dae603f81e836e2aa3ce93865a328b7cd44e560bee7
  • MD5 fd65054f56f7077c515ad94d82d63392
  • SHA1 63a48e65af8911d5aeacc86b56775a27ae4b48f6
  • SHA512 06b96741242ec89b09ece150613257430a6463c769e956fb4f9cd4d5fa36970c5f06b7faaca18c702b92d08a65a1a787057c8b73f2059c9949068ba3cc41e6e3
  • SSDEEP 6144:CIFhuSYWFYgrKsUc3y2WnO1xzcWmZXe2rkwnbo60T21BOcCSrYDEgfje5ig1ef9x:Ph8Mz+sv3y2N1xzAZprkmuN/SD5iKefT
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookowdiscoverypersistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2