Extracted

• • Target

    53d558b2f939bfce7dc3b9d6fdf0cfd92d966bcc7c3cb38e9a0171ef6f778a03.exe

  • Size

    2.2MB

  • MD5

    ba353539a8f310d60005f004fb94e24f

  • SHA1

    ca7006f2345678b15cdaa3fd0e70ec6d05862930

  • SHA256

    53d558b2f939bfce7dc3b9d6fdf0cfd92d966bcc7c3cb38e9a0171ef6f778a03

  • SHA512

    1e1e14b2f00253cb3df5dbe134240d9974992911b9494a620944c9d8036dcf4da14acace197524ccd13826a097c2ad5fe6f441bb46cbaa860b1512279401442a

  • SSDEEP

    24576:5Mq5HYOYUAm1yHBTjstd5nr6rn9VCZvlB1DfA+D0EdPrxPkMN0V9khzb+xHBmN+B:P5DTVYBTKYn9VuvlDjZdhN0T0zbmENn

  Score

  10^/10

  discoverypersistenceformbooknursratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2