Extracted

• • Target
    Pago en su nombre.exe
  • Size 29KB
  • SHA256 fa4fe52b60d9da8ae735fe5ff04114abd194754fcd4ca94c0558ca7f6a3b3945
  • MD5 f19ee52e8d1b10d2b91d24662fa56a2f
  • SHA1 6e022db1a83984e4f02744834bfbe4ac6b03117c
  • SHA512 5a938eb45b7e578a740fa7a0ae9632d4d7e93461caef9c857f9a9b255f82ba94d9abd056df7e308e9f826bb73412bcde3e94ece341b9c2e540d50995924ac9a8
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookby78ratspywarestealersuricatatrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Formbook Payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2