Extracted

• • Target

    sample.exe

  • Size

    845KB

  • MD5

    0a0a91d81009e6f2543b365205d64cb8

  • SHA1

    39cb4d0850b9d29661b53d62ddd47e3d085e8698

  • SHA256

    b422b2744a87addbf9840dc44b5126379adfcf2a1e47bf6987e05616af4547d2

  • SHA512

    da6e5672b21a523dcca1ad45f6b4a88d88db98503955d218d07e6a4522fe1e07c28fcf2b52c5a974ea77b7850dc44b6f4c3b91e19342dbf8ee84dc2fbbb8eeb9

  • SSDEEP

    12288:A1d8c3QBT80DYfXPrk8C9p+AdiH6gZlrjP2V1Vsbw31o/r9rRWPZVmX1Vwm4Dw5z:10dZlo1uwSRWrmXHUDw53Q6F

  Score

  10^/10

  formbooksqxsdiscoveryratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2