Extracted

• • Target

    03fa43931af3b6313fdba4fddae1924a85fbf0345fbf238f73d9ddc282598fe0.exe

  • Size

    454KB

  • MD5

    32ecacb78c39219a4aad99e0849541ca

  • SHA1

    8f1b2f77412bdeb16f9d58bea70dd52610cfc179

  • SHA256

    03fa43931af3b6313fdba4fddae1924a85fbf0345fbf238f73d9ddc282598fe0

  • SHA512

    392879431476b4b095514ed8a4f4536cd84ee47cd09e4cb8d81d59920dbc30cb737834caa5ed9762dfc874a07efd40a25a41da15c23369c5de04d80d2cc26a30

  • SSDEEP

    6144:RT6Uqd2GhN5TebaT+hbE8BuXQ7NwHeOwvGOYLtXy00ynAWGyAu4mpwcFCLFjuShO:RmUi2iNtwBE0YOYLt7WDuZmo4juCueW9

  Score

  10^/10

  formbooku1bsdiscoveryratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2