Extracted

• • Target

    e29feb7fcc81e09ebf6a86b0d620c54e1a134ab98cbd9c13323bf5a6ae7e9088

  • Size

    282KB

  • MD5

    a8566feb30efadda298aa9aa48ed6231

  • SHA1

    3500451818de70121de56672eae034a73674ac55

  • SHA256

    e29feb7fcc81e09ebf6a86b0d620c54e1a134ab98cbd9c13323bf5a6ae7e9088

  • SHA512

    c8ce0767ec6e6c6bbb23169ea5a0981e3dd49b794d09065d84bcc200f27a5543d39b20991955cddb351350f93d75fdfef871f2c6bcacca00abe57cea06122397

  • SSDEEP

    6144:MEa0NZojwkXWEwM3e6YMrKpnTCNATU5H4yjyY:XZ+nWZM3eRM+pnTCn5ByY

  Score

  10^/10

  formbooku6hudiscoveryratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    nqyjqo.exe

  • Size

    100KB

  • MD5

    3d5e9bfede23e9c1b446fc3f9274d764

  • SHA1

    0844992797324021269266770a5c77d31f4ae95f

  • SHA256

    77a8bd4f7e493bf79ecc66caeabfa0e769c8a236cf67c61c94d5f8c58cc69d3e

  • SHA512

    6c8f750bbb4d35c055390d72c3b8232e646390155532517640fa479ee0b2d1891997ff18d26c01a1d66c9d751d3f6215387f1df12d73f0249acdc7827647cb52

  • SSDEEP

    3072:qiOJNQvDOGx9jVgAdE9UsbbrkQFqhDJ255C5M4Q:sYDJXgTUmzq+

  Score

  10^/10

  formbooku6hudiscoveryratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral3behavioral4