Extracted

• • Target

    jetsjets6654.exe

  • Size

    1.2MB

  • MD5

    957242e6d5769a32406189f7f05f50af

  • SHA1

    42297b45d76f9c475842fe6cbc60426aea470d8c

  • SHA256

    3eeec1884c0a7d2c7c49991d08bcf731f563fd55faff77cf02b5c6f73f34b5f1

  • SHA512

    e812a0d87b4c3af2bc2f7c25cb11256414a1b9577e405f8e0cfa86384bbdb998da21fdd015c17c57188db4e107b746acc0d579504b81050c6e1af05b101c305a

  • SSDEEP

    24576:iAOcZXp00Sjm2GbobhjkmK3cLSzv7w84UopeOH+2UNUquptQZCU:oDl44U3hvUUbJZupXU

  Score

  10^/10

  formbookje14discoveryratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2