Extracted

• • Target
    LISTA DE PEDIDO.exe
  • Size 509KB
  • SHA256 b5cde2a22949e65c3eb965bec3fe21cc3edd2d83e5a1631bd705ab8f649daff7
  • MD5 9de8d5e1efbfa68c4382b3a485f159b2
  • SHA1 97175f915b0fe221c832b991ba5d0751afdf7750
  • SHA512 2582e27cdb2d609cb32baf73b0a11ebc575cea8c6d4bb0205c10d3636a9dd092867c1389e24345eeb270bf9619d387eb0db714cf982f54c93075f138793d2795
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookgn27ratspywarestealertrojansuricata

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Formbook Payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2