Extracted

Extracted

• • Target
    Payment_Advice.exe
  • Size 25KB
  • SHA256 c5b6415df416f3cfe28a72004a02c3a7d2abbddb478a945069e6e20a71215e22
  • MD5 56e69dd60ed600fd0a350af3ad2db7ad
  • SHA1 a6cd168299031cd4c1648dda71060ea5661f1dac
  • SHA512 cf76b7076249ba5bd749e1638c167de20437747d5e79b7466c429fb3d55be919cdc87c7b913f52adbf8ea5a7caacab6ba1a1f98a7ab722ae7d0e29d47bc199fd
  • MD5 SHA1 SHA512

  Score

  10^/10

  blustealerformbookfs44ratspywarestealersuricatatrojan

  • BluStealer

    A Modular information stealer written in Visual Basic.

    stealerblustealer

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Formbook Payload

    rat

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2