Extracted

• • Target

    1102670247.exe

  • Size

    1.2MB

  • MD5

    698a3a3a5cbec27c26d77863e3d92d28

  • SHA1

    ea49431ca823990a6a50c50a183a78a24b4c163b

  • SHA256

    c8dbe8b8a92f18c8361b78167dd1f079d5d41b3a2e48065aad717ab07fc62027

  • SHA512

    4859433c22450025831b750f26e8e584bea8ffdf07b4a59075585e134197f8b82768a9d37a0449ac5a33adda5dd39fa632d1db9ae2ebd8a6d47f9de1b9a42ec2

  • SSDEEP

    24576:UAOcZXcxP6qa5JWwElvJpUNsUCl/NzyyRiP6n4G7/AybB6Tq2HR:CHF4JWw6vfjK6F7LdgRR

  Score

  10^/10

  formbookmn21discoveryratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2