Extracted

• • Target

    quote.exe

  • Size

    1015KB

  • MD5

    d239aa442968f1ecd78ec3fead79f1c5

  • SHA1

    28d69f73c75a419ced1bed487f14ea09dab85b7a

  • SHA256

    9701e87ea4beda798663d1e09569103cc9dcf517e2e9ad41d0f9304247cf2f1c

  • SHA512

    c030f718b976b856d2aad62f9de5d7298139bd2dc718c796693007ec59af7d985ec1225a278715a224a2fde20421867f6d318acba4968854083e8085828b1395

  • SSDEEP

    24576:BWzf2ryot2cyzmPLtEux5fXDj7RplYRIVcfc2:BWCMfG1xj1plYq9

  Score

  10^/10

  formbookgbsdiscoveryratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2