Extracted

• • Target

    a52d0bc31a250c5dd5c84c75fca9b965955297d20f582d79849c17fb59c4c04f

  • Size

    1.2MB

  • MD5

    8f6f8bc43de5fbdddedb774a22e3dca1

  • SHA1

    3f48029084649e39963710b0ae114b4663d48e68

  • SHA256

    a52d0bc31a250c5dd5c84c75fca9b965955297d20f582d79849c17fb59c4c04f

  • SHA512

    ff48e557c37a8ebda2d9504727681dca35353003e87369e5462fb20a1c4746fb998200130b23518288a2bf7c4af06e8853937251af7b2c17e94a46d39b991797

  • SSDEEP

    24576:7AOcZX4ctcwhwheT60L/2NgeSMj5HHeg/cbGOSMIEn:dPwhUwvfe/5HdYGOSMV

  Score

  10^/10

  formbookubprdiscoverypersistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2