Extracted

• • Target

    27db806a5b1919f930f40810624889f20bcafaa485c89d4ca522fe6335dfea1f

  • Size

    869KB

  • MD5

    3e71d2e715046c0f2e8241cdccbefe4b

  • SHA1

    754f41de14a8e2e03a0df5d16d7c54c85dad1bf2

  • SHA256

    27db806a5b1919f930f40810624889f20bcafaa485c89d4ca522fe6335dfea1f

  • SHA512

    f4158e6b9d4265bbdb6f9522f947927c93c9bb25ea0f517dbc8a8f0c7c94d9224a1e7e8e996b9ceef7aee9e869c5a7a7512f665313e0bedc2c8ec369531003ee

  • SSDEEP

    12288:5eYYBqpmHXjNQWzqQ+Prrq5SdIBuIz++T46XQo0/T1jct2NjFWOHeF:5HYBTakbC/q5ScuIzdM6kjcMNjP

  Score

  10^/10

  formbookodsediscoveryratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2