Extracted

• • Target

    TRNSF.bin

  • Size

    1.1MB

  • MD5

    fe9fba11b0354b03ec4374321cf5d7f2

  • SHA1

    5e52cfbf1f5020337a2bfafe83881217df3869dd

  • SHA256

    1fc7c86df7aa45224f6c8f4a94513663dfe77dc79603a0c1325736c376aa68e2

  • SHA512

    41f9145b538668034d4812ac5cfc8020c59a9d905715b8370dfac6fde11ca613bb1a70c45819883244af81798b5370e3542001bda0bc783c7d1ff1a7160511d9

  • SSDEEP

    12288:bmqWFHmsSSMPQipP5JG/UXU9l9SG8nB2A+WwWL5ED96ZaeAiMJVpQhoEp53UC:SRHHipHCUkVWB2hr+ED96ZyquEplU

  Score

  10^/10

  formbookgbwydiscoveryratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2