Extracted

• • Target
    SecuriteInfo.com.Trojan.PackedNET.389.25536.27491.exe
  • Size 1.0MB
  • SHA256 baf5d53f07c0cc8ed9ba7055cc91a18b936d0342e0792f618ee6846cbb8859b6
  • MD5 5865d0682ca9d862abb1d89a39a58bc3
  • SHA1 3003585cc405e33c123b5943ee513d7d58d70919
  • SHA512 75353d4ece4cf1370a59112c6349224540e98cad9ca19c81184c42bf12bba7f58fe89667bbc8c9bb355fecedab277c7ebca5c0d3a81b84af68bdb732cc30c348
  • SSDEEP 12288:u6tu6n0oHLU/UhMIDDovGDG7VH1NG0EwK0sw4gvDy/CeHnNCqjfeAGYikxW/r6ZC:u6qEY/U6WMvdVVs0l6gm/RnNCqjDA/+
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbooka4b0ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2