Extracted

• • Target
    prueba de pago.exe
  • Size 827KB
  • SHA256 4339504bc2ed58024692ebf1d7d3c02e9d5672a670136f97767f5e30fff831e0
  • MD5 725cd53850cc7b5befa1f2bfd6158949
  • SHA1 9e6a950ed7fbbd7f21851e214d984a999de8d386
  • SHA512 562593ac810d35c5c744f44340b9b4e963895ea7d25b65b1f6bf4157d0bd31d0f87b2b3bea72403455aa9b5400670cf4465b60a88cfd549143a400ec11e5e55a
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookgn27ratspywarestealersuricatatrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Formbook Payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2