Extracted

• • Target

    DFI-6059.jpg

  • Size

    406KB

  • MD5

    69a1012645e68ec71f61e3e623cc1802

  • SHA1

    e9c94760b171eb223d28e66ac67e3fc50d1494df

  • SHA256

    37cea6e5502e8caea195462fdb59b168d238617f2918f0562804f8e6bd2cd9d0

  • SHA512

    b03906bb2a280f1609f5ed5d22116d238e5dc88b8f85ffe0cba99a4391265c457c08fe2d1adad2dd006115828bf530c32ace6e097b4d23fd7c9054c758cbc912

  • SSDEEP

    6144:aJZj3XBjlkq27zgxRb01xJIdtNMlY0u0UC7lYA7C:+zZo7cvb0Jq0PL72Am

  Score

  10^/10

  discoverypersistenceformbookdmrratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2