Extracted

• • Target

    SyncTextReader.exe

  • Size

    1.1MB

  • MD5

    3a1133a31a67b64ec6165ac328098fdf

  • SHA1

    43c43d1025925785a23ec4b160dfd566135266ca

  • SHA256

    5f8719f381c3dbe465082297c7ce0d2af2954503f737592f19313ac19f9cd294

  • SHA512

    4014477c4f2ab52fd54747891d14e5817ee7090fc2716c1837284f9887b67c58f697278c22a40c4ff30d9d40d16b0e43b907a2927272152b68b6fd4e4bd1db37

  • SSDEEP

    24576:bU1zwrxR4lWzWzm1ejk7ZDsLCoFCS4/d8:40R4lEWzm1e47MCogH/K

  Score

  10^/10

  formbookj7ediscoveryratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2