Extracted

• • Target

    formbook1.exe

  • Size

    433KB

  • MD5

    9672b2beca3027b6f008dfc291d21777

  • SHA1

    9dfa2b2cc3d1f04fd715068e9eee238d6b1ca5a7

  • SHA256

    ba10a45e13a79398a5802c91636684e54e53f26409feed99e7c89bbbe0c720d3

  • SHA512

    6396c39d4b9da16e541bb29659737d9841c5841c808c58a7d88accb35715d673820d63679ea0e0ff7642cd952158e11029b5fd689b0588cff8987816df3ccb2e

  • SSDEEP

    6144:6bE/HUrUAGxkcrTRkHqqZMWq1cD8YGMOsPEF75noWa4zbzDp/TkLNlkDfkDSDr0x:6bkxJkKqx4rB75HpALLkD0SMx

  Score

  10^/10

  formbooknrlndiscoveryratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    nbeggsncal.exe

  • Size

    131KB

  • MD5

    669c2269eea6c11fd71038f0918193fb

  • SHA1

    b2da793470b99bd215fbd9b3c7396ac402b068e9

  • SHA256

    ba605ae9b548c05ffa985ddad9217cbdd99c1aecc83ce6e7cf36a162cb69938e

  • SHA512

    0759ebe446901ab0974ff7cdac1b5517a7a739890a20858da93aaec94bd06bc4e6cb697b706864d78df044c41211990185b4bd9c00a24c616ce6004f371bc91c

  • SSDEEP

    3072:BwL4Lf/x2dKZb/m4bhAPfUZMCn5OnUORrOhm1CsrTzx8iB10V:ikdpR/mm0c2RrhFrh8m0V

  Score

  10^/10

  formbooknrlndiscoveryratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral3behavioral4