Extracted

• • Target

    MalwareBazaar.4

  • Size

    810KB

  • MD5

    60bd782aa615ee9354c2221b4ad7b80c

  • SHA1

    f753f3c3c359b38c1051064417d6d0daf89db2c9

  • SHA256

    62ca1c39badbfbc52c6301cb69c8356977db57656c6d98dac7e4ab908753af00

  • SHA512

    0ddc9c16ac39aa6c006bd8ccd11194267b73d646b304f84b911153832dc7a6c960d60ebfc08d0d6314630e124e575bee4c81c75ffa7915faddaeae5d37b351e3

  • SSDEEP

    12288:1y9WilQDz/bhj+nm3m6SsWCG0tP+KpIMD5w2T7S+w74fNJ658N:1wQDfhj+um6SgDEWHPdL65

  Score

  10^/10

  formbookrn10discoverypersistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2