Extracted

• • Target

    98a6a5e789c33737c74f6ee52fce41a206867e571c8b8286d3af6f37174dceea

  • Size

    1.0MB

  • MD5

    820de48affdf7a70230640b8adb01f67

  • SHA1

    f8f004884c53f8e55fff249a851a614dc2f34bcb

  • SHA256

    98a6a5e789c33737c74f6ee52fce41a206867e571c8b8286d3af6f37174dceea

  • SHA512

    87f1482527d41fe7fb8e715551f69a00b25b62c203bf814032caf200cac503ac39b7464814c64f83d27fa99ec4d9fd1268d4fad6a959d0860dcd42858aa27abb

  • SSDEEP

    24576:HeUVYtXiZ4xN3f7a3fjyOlch/TMtdycjRI/F3:+UYtXiZ4xxzar+oKcja9

  Score

  10^/10

  formbookdei5discoveryratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2