Extracted

• • Target

    texttvieww321.exe

  • Size

    1.3MB

  • MD5

    7dd3986b7546f3f40d22a60aa2ff6023

  • SHA1

    b47f96c5ae85a3ee7c571074208bfaa7a968f673

  • SHA256

    919a696629c2c0dd9679be7630ada2b1e1173da3bce748980b07fa360872f727

  • SHA512

    5d95b02b8c626912ede55080579032aeafa969d3a95f1842570c00e514bc5b0fb1b31825b393148bafad99f05406d97458d93e79cc12bbff91b6d2c9a151626d

  • SSDEEP

    24576:iAOcZXp0wL/6dqr+LXTcpsBIUkjPV99npuezy71oporahr:ocb6EcjAsBIUkj9fZe6Gs

  Score

  10^/10

  formbookt01wdiscoveryratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2