Extracted

• • Target

    0791e8ab1ff5119cb4dedba8cbd260f6a163100eb60657cad11f494cb34bbc71.bin

  • Size

    409KB

  • MD5

    d7fd44db6ff7913a79d60eae65422594

  • SHA1

    00bdf1e46cb1c7a9f0c2d2b354482213517f2c18

  • SHA256

    0791e8ab1ff5119cb4dedba8cbd260f6a163100eb60657cad11f494cb34bbc71

  • SHA512

    b18ffc00c0b5c3e07554d846aa6ed3c99913f81fee441c09db54f77ec717a4161bc447d47780d6a16558f0e96757b1c5e98298dd994ca2ac4ed5531713114fa7

  • SSDEEP

    6144:IzvmRaG/aq0YEYBJ6gjiOFuBt5a9LwNCKFYc/z3EHEle70IEU0rq/UiAY:IicGX0YHJ6gOp+LmCmz3EH1Ft/Uil

  Score

  10^/10

  formbookdv9ndiscoveryratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2