Extracted

• • Target
    5c106f1abf307d69c1e95bf13598b89a
  • Size 19KB
  • SHA256 520f7cca2676f2ce7142e200ea8b52a4e441e59ab44778e513203c1f4429efe4
  • MD5 5c106f1abf307d69c1e95bf13598b89a
  • SHA1 607863e31928eb35bc6a5766f5be9f11b6a3b39b
  • SHA512 5a6f139c319d70cdf06eec2f86c1ed67e84493d59818929f1e21965711e045b35c052ae454c830d579aaefcc7d5a38475ea7ec1940f7ee25268ce74b7420cd5e
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbooks4s9ratspywarestealersuricatatrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Formbook Payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2