Extracted

• • Target
    c12a88137a0676ae55c4c77d5d4932d0.exe
  • Size 260KB
  • SHA256 167f095c678aad5d26949f46d21bd2bc07744b09968d780e310484b42404580e
  • MD5 c12a88137a0676ae55c4c77d5d4932d0
  • SHA1 2f1686c543ed90281fc983e95123e8f6c7a9dce9
  • SHA512 d3a81c4aae6f5863ed368648f0440f75397e3f2ac60c507f37b58250db42dcf192ba701b0cfb10d98b1bd98d9785761ad37c803a4b2837e45e77df3fc6c86a63
  • SSDEEP 6144:HNeZmwzYdsGNMiVdbU0Qvoro999xhgA2NhHk7+dkTLhuAT:HNl97LGDrhJBr
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbooktsuzratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2