Extracted

• • Target

    ea4fe51e13f6ab1785535b32345f69ef110e21981bf7dbb09ce02c0bdec1e43c.exe

  • Size

    616KB

  • MD5

    33597eea937de9fc85c91fc86d4081da

  • SHA1

    221c42c79cb047ade2346e1da635a1ac359f06ef

  • SHA256

    ea4fe51e13f6ab1785535b32345f69ef110e21981bf7dbb09ce02c0bdec1e43c

  • SHA512

    7dab2e8b3b8852cbe61e6f17c6adc67b1c2662e3f1a4178644d6dd6479be6c549442fd1598123c1f08c13417d647a7dd6d9f530eeff31026d6cecfea04d965f9

  • SSDEEP

    12288:73jM8fLuh/ABkePJNbT3y1UkuEtnrCuk3aMVa:L7faAimNbjkxtnrCzVa

  Score

  10^/10

  formbook3nopdiscoverypersistenceratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Modifies WinLogon for persistence

    persistence

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2