Extracted

• • Target

    e0ee7fe891f5d36b1b41e16f94c53a99e74c81ac3b721b639867fb0a5043c99b.exe

  • Size

    1.0MB

  • MD5

    c40a2bb2a9f720c9a89d160ea02b8ea5

  • SHA1

    4067c68cb8f7adf5a2a36dc3c5129ac4331c8e7a

  • SHA256

    e0ee7fe891f5d36b1b41e16f94c53a99e74c81ac3b721b639867fb0a5043c99b

  • SHA512

    b87e645df0d8bbaef47361f92683eb8fca6983c1a14c7955e12940a6ce97dec761451a30dff1e0abd83b278cd57a1b4874086dc1f7c5d1d9b6d85bd72c2423a2

  • SSDEEP

    24576:RN/BUBb+tYjBFHgLE6FI9Dh7wHIYG9V+X1zJ54D+q0lPBzkFC:zpUlRhGEnw+T+X1zJ5w+JPBAC

  Score

  10^/10

  formbooko52odiscoverypersistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2