Extracted

• • Target

    pos.exe

  • Size

    454KB

  • MD5

    0082bb1c3ac5dc499f6db3d45de0ab3e

  • SHA1

    90eb55324f4068a4fde1da25ca7a3eff65d17e1e

  • SHA256

    1bb913d6f594107a8c8d4d64f9a3de85c602813d9ad93189b9949fbc8a93aa32

  • SHA512

    e42c5af62527c2193d3f49f93918535b656f9d0a34065657df8273e606405b551e9f939450a134c20c58429951fbe7a27c14e19e66eeee57446349eaf7e30384

  • SSDEEP

    6144:RT6Uqd2GhN5TebaT+hbE8BuXQ7NwHeOwvGOYLtXy00ynAWGyAu4mpwcFCLFjuShC:RmUi2iNtwBE0YOYLt7WDuZmo4juCueW

  Score

  10^/10

  formbooku1bsdiscoveryratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2