Extracted

• • Target

    STATEMENT OF ACCOUNTS.exe

  • Size

    464KB

  • MD5

    bbb834f13790a853aafd0d0adab527f4

  • SHA1

    8b20c41d9c082642d9d7c858105d224b81f6fdc2

  • SHA256

    c1b2a36d08dfb9bc18d53112299e6cef0c5057885918a4485b8f1b87a20d709a

  • SHA512

    68303db868b5bf9897e636caf946c5dde5cf28e0590649e1f8e4b0e998eb7c1ea599b87c95f6f7361effcf6fb04737168ed15d9aad95e77acae3dfb619cfe87b

  Score

  10^/10

  formbooknflpersistenceratrezer0spywarestealersuricatatrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Formbook Payload

    rat

  • ReZer0 packer

    Detects ReZer0, a packer with multiple versions used in various campaigns.

    rezer0

  • Adds policy Run key to start application

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2