Extracted

• • Target
    ca3a57a6b1feb39cf130554c73ca8681.exe
  • Size 40KB
  • SHA256 bbc249b1ba93cacc8bae2d88ae2bbe88fdeedcffcc35f55645acfe94fdc67bf9
  • MD5 ca3a57a6b1feb39cf130554c73ca8681
  • SHA1 f7b0e31a12b866dec0fdf82fa8657401132ada45
  • SHA512 53d0dbac166a3c65460ce8b478629cf920170bb615705df87e327b52e31369f4bbf841634ba6223bcfd0054638701b87e3b7331da1743f3f5c6e46f1e8e27ef9
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbooks4s9ratspywarestealersuricatatrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Formbook Payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2