Extracted

• • Target

    a1cafe0d39cc17c0e36db2afdb4f640e3e81da7b2302c01e03c96348723ffdc9

  • Size

    1.0MB

  • MD5

    7d8165e194302250d880425b1608e307

  • SHA1

    2688c9a6a3946fd7d93fd861c5f94c0dd67ae593

  • SHA256

    a1cafe0d39cc17c0e36db2afdb4f640e3e81da7b2302c01e03c96348723ffdc9

  • SHA512

    eb1c4dd9095dcd6a82616f7d4260e45ee686e4c80c0f046639fdae08fd5c70ead604be0d4cce09d01466b239726c93ec4de579222eb755c6cdf641fd902c415f

  • SSDEEP

    24576:hN/BUBb+tYjBFHNhM6FI9Dh7S95UqJXRX1zJ54D+q0lPBzkFd:jpUlRhPMn2owXRX1zJ5w+JPBAd

  Score

  10^/10

  formbooko52odiscoverypersistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2