Extracted

• • Target
    Shipping Documents.exe
  • Size 617KB
  • SHA256 b3d586ea6f954e72cd9c39838dece4a7e019d7f1916f0984da816d107d03ffe3
  • MD5 4d2317fa510cb2cb72330ea66c50ff4c
  • SHA1 2c4cdf4e9e1db74145c1b48b655c127e7eb6c596
  • SHA512 f0d089f0b51e3cf0e9c157d79eb7d9fd3e21630806f960bef77cc55e1073bdda88f9d51f62d4267ad1a547e3c82763e7f87916859e7069408abb2748a8178373
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbooko18jratspywarestealersuricatatrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Formbook Payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2