Extracted

• • Target

    0b504e6f2a283de75673bbe913c5032b02cc6a92888f4dfab895f79104b11103

  • Size

    564KB

  • MD5

    633bb3ab12d6fd7b6956aa3a93f55e9c

  • SHA1

    f4a72da6391fcc9c623ae26de27fc80f10cf9f2b

  • SHA256

    0b504e6f2a283de75673bbe913c5032b02cc6a92888f4dfab895f79104b11103

  • SHA512

    ebdfa42be8d8f1a64900ba48748c8f86d9b74defbf85b3dda94d1df4d7c695d81769e165252fc0cfb2b5ffe347d84eb2f4f74e8d3e3d3ed3fa6466426f4eec28

  • SSDEEP

    12288:zToPWBv/cpGrU3yJYqi+4mMz4pbIQ4+N54CHLottc:zTbBv5rUGdf4m/pMQ4m5nrJ

  Score

  10^/10

  formbooksk29discoveryratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2