Extracted

• • Target

    textttr4809.exe

  • Size

    1.2MB

  • MD5

    6a85b6fadb20c016b98e8ba0fcdfcc44

  • SHA1

    c5c423ccfd6539ba04f56221bbb79c83baa93be4

  • SHA256

    b4855381993299ec39524043aa7f8898a4fe64524ab943bc1db297f62c181824

  • SHA512

    3e5827593da1dd78df4776ddc35f519791ea45ffa6d6d371b6b531ca4b0a030b2d8c296e093488beda886ad652e281c32f7aa830d57523730287c53621327e5a

  • SSDEEP

    24576:0AOcZ2i7uyaiDbX1Z0JsyNVaCpaQj5HUSIOg0+MkYGEy:igDbX1asyiCcw5HPnS

  Score

  10^/10

  formbookt01wdiscoveryratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2