Extracted

• • Target

    Ayu4oCFjm9OnXOp.bin

  • Size

    432KB

  • MD5

    f87c0f240f62b4cca561779d456a119b

  • SHA1

    c56269f25c5c23b2e7061e3b13c3e0c3fd27f7f7

  • SHA256

    d30712d30f67be6cc42c17e78032d44f858ba45aa58c767b756874e25f6938df

  • SHA512

    4ec4be2b361bf4c9c009a6b2c3c4dbe5cc4dec31f17d5507708fa7ce5f704452d03ee97dab6ad0f52e9972c2f919e20d243e9ce945aeeeee09a02ee43e6a649c

  • SSDEEP

    12288:LgQts9tXZ0ybmhFZ9lrzfyXHFD4j5HgXm2ijk:LgBX+Amh791yVs1k

  Score

  10^/10

  formbookajrdiscoveryratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2