Extracted

• • Target

    75bb0b6f8768989a20b3747d883d00f5c155d7a8d80b7bcdbfdca4931b5b2a6a.exe

  • Size

    708KB

  • MD5

    eb72fadbc1db5d28ec6d93da22478c4d

  • SHA1

    2018ac7614b99c73e96a24cab4f9f2bd08c289f2

  • SHA256

    75bb0b6f8768989a20b3747d883d00f5c155d7a8d80b7bcdbfdca4931b5b2a6a

  • SHA512

    acca35fc08637d29469c27ff6f44e28470f022fe419257c3deb77dd8a19e4ddb31f4a0b69bc6a991c27e5f8ab70a9d84762c6ffcb4434181964facd1185d8dc6

  • SSDEEP

    12288:OrzFejO/H4b3toyhFHKYpJ8fKLpl5k4DbF53e0IUFLLC6GQG8P:OlAOvOoyhAYpJkipd

  Score

  10^/10

  formbookmynddiscoveryratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2