Extracted

• • Target
    5df93ab049f7e6b8221ba6ec6187898b
  • Size 17KB
  • SHA256 7af1842cdbd37f5e68d3d90350fdafe36d78cb62dee2fbcb2a4a4a9184b8d95c
  • MD5 5df93ab049f7e6b8221ba6ec6187898b
  • SHA1 de24ed536e666b35d49524ed14dc533edfeeba44
  • SHA512 cb2e6ffd7823554cffc31be97f16e468b52239afc58ab28a0e6897402648be66ff77a017c0fe43148002fc07fa2cad8181304cecce8242d63496456780b8336f
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbooks4s9ratspywarestealersuricatatrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Formbook Payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2