Extracted

• • Target

    ySNxzGtmAt_bin.js

  • Size

    343KB

  • MD5

    2c1b8ce86a48542a827bb302d54eb19c

  • SHA1

    6c5b668d122791450edb50027312f22d22eeb39b

  • SHA256

    c89f8224348c1c86bf84db8a6596f1ff4fdad498669918393fc6325b7a1476e8

  • SHA512

    88bcb4feb1e9a0dfc378d106faa5e979c1505c17483e9ae7e68e8782f0563ca0248f712f0f1b384d7c97b7ef65e0665b72af28a5b9852c030cedec7c67ab5e65

  • SSDEEP

    6144:P+58K9NNqVEmncYRk/ykRCa7ljUuqeYGEirkxMdv1K8glhknGC80F0+WwpOj:lK9NNqVEGVRk/ykRCaRjUGHjrkSXK8gT

  Score

  10^/10

  formbookt01wdiscoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2