Extracted

• • Target

    3cc61e3b10971812969457d5c2f23ddaffd81ba130c8b0a13614e81988891261

  • Size

    919KB

  • MD5

    fef7047ab5a223c930108b5b61e332bd

  • SHA1

    25f25911db849bc152a097ecc3a5e46e5a4aa3d1

  • SHA256

    3cc61e3b10971812969457d5c2f23ddaffd81ba130c8b0a13614e81988891261

  • SHA512

    73ef3ff8bc916155b467de260dcd0f4484f1771dcfc2035bf5f80f855ce073b6e5b57c28810d7da0535c700579ce6bcc8cf3a22d983d7e22e7667dbd33b78f3b

  • SSDEEP

    12288:fPDc9F3nC0Py3gAhmioPFg/Krib63eLojTLKvdgtaFs9Ab9h+tT1Oy3fRWCLWkbY:fQiQ1roS3XYdsYs9A63R7L4

  Score

  10^/10

  formbookodsediscoveryratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2