Extracted

• • Target

    898119779925cbf127343563ada43028f69dcc47b1a50a8ca5a8b1e5a48455ca

  • Size

    1.0MB

  • MD5

    ac2855184f7d04050f0eda9b69ab3e44

  • SHA1

    073c2d08b6e2816dce26c0684faaf632193dab7c

  • SHA256

    898119779925cbf127343563ada43028f69dcc47b1a50a8ca5a8b1e5a48455ca

  • SHA512

    f2142500b6e1966d739373c0abd5734eb4df749be8f3b12cd90f32631602c78e803a7b19995c8ea0156f9979ae60bde42a96d61c3ee0b515c931e26a5271f54e

  • SSDEEP

    12288:/WHMZAWd1lcAWd1lGGDbTKTxnnaAym1pj+INy/FYJR/A/259nqgxiaUc8+bCfeKs:AIFqF81bpc/6Yu5WwqQ

  Score

  10^/10

  formbookm21ddiscoveryratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2