Extracted

• • Target
    boleto de pagamento.exe
  • Size 405KB
  • SHA256 2099d310f5fc3d161fad8db45a1e8d555006869871d52e063c0760284955b75e
  • MD5 51467470255a8544f799355fe2418251
  • SHA1 3209f7bd27089b0c95c32fbe8846965f714f4fdf
  • SHA512 d58af1a34f0fbfc987d7c270c22d5c9c3058a35c757b8a080363873e605a10b6ff4738a05cf5e622a804339d230ed76727617167a3fd3ba237ed99a47816cce7
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookgn27ratspywarestealersuricatatrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Formbook Payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2