Extracted

• • Target

    89f32b16d874afc972f69f0108ccd4b163427bd30d66f2ee07f0771ac0f47d54

  • Size

    879KB

  • MD5

    79dc6309e5428498138288258408ebec

  • SHA1

    bd9b708b3743278df0a6c3a494dc8e3a0c89ed6a

  • SHA256

    89f32b16d874afc972f69f0108ccd4b163427bd30d66f2ee07f0771ac0f47d54

  • SHA512

    1b2d3b0dd1e7f43264ed0cd535b4095efbf3f635b988893556450d3d9654fb6d494f8626984d31b7605730c7ad1a8b38e0bcb1bb24ad8099c81e96c78e156ce4

  • SSDEEP

    6144:KrNLru22ulz4ntAC/cl47K9jYhCioJHBqVBixGQX1PfBOeVOdvXhNuxD9JJYWU:QNG22u+Aq+sMhqV+GQpfFVOxXhNu3JJ

  Score

  10^/10

  formbookdxediscoveryratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2