Extracted

• • Target
    Payment Confirmation.exe
  • Size 632KB
  • SHA256 064b63296e5ed2b796567b20dba4dde90783018b9058facf6fe407c360df7779
  • MD5 e6e980686110b2e688ba0abbdc8b6ff7
  • SHA1 759682422be8d1df52d3725876380f1b690b7c7e
  • SHA512 ab1d200a2af619e6b811a7289ee3fb92af279330c8e2a8ebd3bca6d37c813b8d93532e8ccfee9f8c35a7fd3df09c5aae8f2b420cdca8a3f29067ed01674ea382
  • SSDEEP 12288:xwhuJIQvV4Eiu33NUQBXS/4pboT4GSi4otf4VUcBkLCCY3zps7:iuJd/iu33NUUi//4GRFtZcBmC3Ns7
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  formbookoi05ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2