Extracted

• • Target
    9f031a71a8f4dedaff85f360942cd0b7.exe
  • Size 14KB
  • SHA256 ac23d509999ba6aeffbf49a41e104a7e876872740dbf24ccff54f5bc36ee3eb6
  • MD5 9f031a71a8f4dedaff85f360942cd0b7
  • SHA1 337686652fc8aa067691eb88e00734b477ca86e5
  • SHA512 72ee3d4db1507147eeba417f0e69063a123139d9f1f2216927b006c2aa32f9aa0840ee45d74afb8b6c47b104949a9d7d05117e8a7b88bad478fb45521862b42d
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbooks4s9ratspywarestealersuricatatrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Formbook Payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2