Extracted

• • Target

    DT0912.exe

  • Size

    1.2MB

  • MD5

    35605d52ce7729150f07f79a6d14a415

  • SHA1

    f123414e65aef81242fa4cee2779de1a2a62d377

  • SHA256

    7f5165dc64cbd376f256758989a91cf0600173d59f4384ad112a40dce8db530d

  • SHA512

    20e14a0cb568d28d7d94ebbfa5a053fee8f547bc03b3c7888263d50f2438eed86d71959e8b0eb4d9b79c279fddc68cadc5da0e6be850f58fbbc497f3253b9ee2

  • SSDEEP

    24576:iAOcZXp0TRXJFPJ0MK8WRyl/ZUkjPV99npuezy71oporahG:oFXPJ0MKzYhUkj9fZe6GJ

  Score

  10^/10

  formbookt01wdiscoveryratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2