Extracted

• • Target

    payment copy.exe

  • Size

    622KB

  • MD5

    b568ccb4efb2fec5d08b57b21738523a

  • SHA1

    021fdf7117c2623b11a6914bbb7294e467993e57

  • SHA256

    f6fba16427d82d11ca8da3b8b1ba0b47eb9719da38a44c9480ac73466e932edb

  • SHA512

    af5374c7a417d66d548beb6caec78af4a217f1e6677afcc6936bb198100768e6a9a7f671095cf1e90a5c802c3bcaa36eaf699d92d7064390bcc6818d74dc09d1

  • SSDEEP

    12288:l9FfLVUE06PTli+kt43t17lG2ejs0Od/fD1t/QJ1jSC:l9Ff1TwZ6D7l3ejs0OpL/QG

  Score

  10^/10

  formbookr4gkdiscoveryratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2