Extracted

• • Target
    6918e243c51505d5769b394fbf8e29c5.exe
  • Size 12KB
  • SHA256 5bc5d93665bc0242f56ecf2f76c0d25bfb8d78536ad9ea4fea4e723500acf59b
  • MD5 6918e243c51505d5769b394fbf8e29c5
  • SHA1 37623ba59abf882d5f776150581c39f0558366fc
  • SHA512 752ac197a95ae3a4c170ca691de1d2ad586ce0bf1ea46f494d8d6a64887c176e6ef6f93ef36d4248240033352ab8691bb91b3e18c1b4e2e40e87e3fd8d05810f
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbooks4s9ratspywarestealersuricatatrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Formbook Payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2