Extracted

• • Target
    T?cili Sifari?.exe
  • Size 1.0MB
  • SHA256 77de2fa49e24c93e217088285cfcc816cf7ae40928898dc3e88c0d6a67a31c80
  • MD5 102a540303ec7665687ee20c6a6f3829
  • SHA1 dc5b7f0a3a72215e0fb574ffae9dc1ca80d8394f
  • SHA512 887c9e35701b2a8d53a5973f423b10f6c4312d112fa77ee64453f43a451b5f34449f4e0cb7c5974efc73a3621ad1fdd43f7b88ec34834c6bced162364cd6a5b2
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookd2g7ratspywarestealertrojansuricata

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Formbook Payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2