Extracted

• • Target
    soa-jun22.exe
  • Size 1015KB
  • SHA256 7f6242e9dcb1ce45c70b22d3c87b36b04fbc0b65d7f7ec07b008693d8763b66b
  • MD5 77582e81081ce2f61021a53f0529a5d0
  • SHA1 b2d154e767b2d7986fc9a48b179f7b7c3cab85d1
  • SHA512 de652dfde64a5133815f75a75a3a491545822c4eedabddfb43dd23504037ceee4b17554750a960646310f219def41725013ba381a41793da51d38a992b983566
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookfs44persistenceratspywarestealersuricatatrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Formbook Payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2