Extracted

• • Target
    Ödeme kanıtı.exe
  • Size 809KB
  • SHA256 503f221f367baedb8a7c4aa592c21af73eb9bf6be4fe4a18b5588c0e9e6f9e23
  • MD5 85dd83ecde842f52cdd6c2e144eaed7d
  • SHA1 8e422311d20c1a735a31f3976243f44992ab40d4
  • SHA512 4ab2171cac5459791f6458bc8e3fccd4a7cf902391526841f3f59afbd3fcb0bc7228833f477878b9b75e3c1b30800cf89082b36df531e00795d3eb7ec949095d
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookgn27ratspywarestealersuricatatrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Formbook Payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2