Extracted

• • Target
    Inquiry.exe
  • Size 572KB
  • SHA256 e13e08e3de1d9fa5a1fee56048118bf59a11ebbadbe2b38af4f10fecb6d29796
  • MD5 82fc4f99deab2396aa0d090fe2fdb243
  • SHA1 32de8de06538f2160a40bdc39ccb761a27fbd3b3
  • SHA512 d83527dd1aebbc671a668dbbe355d2008e62bdf3f9226ece8f76bc7f5e177ded9485de9f6a7598729486002c3cb049e5e049e1e4acf18318c6a71f31ca6ec897
  • SSDEEP 12288:0h7eU/qSNAo7hNlRXWiy7eR158pGloF38cm7DEyLL4:1UJb1MiIe35gG3EyL
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookoi05ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2