Extracted

• • Target
    INVOICE.exe
  • Size 966KB
  • SHA256 89a9b77261ed533dbce028de014c1e6b35ffae6419d2c9dc12178bfc49f7e5af
  • MD5 5714f2783f8f9ee0f728070a72300534
  • SHA1 50d17bb2dd02c0f53676ff051cf463b07cc1be91
  • SHA512 d6d1b14e94344a00384f933c9c55a41cfe33262618542795a73599212f1e43d7c8ca2816f349cc99419bcdd7ec46ddc53bb0b5e7e9b1d898236e1e84aab74eb3
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookm29nratspywarestealersuricatatrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Formbook Payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2