Extracted

• • Target
    MR# RFx 21-2034021.exe
  • Size 1.1MB
  • SHA256 7f3e97e42369a76be6688dc29fe71b83b0754acc7df08a6253460e23da7d1ce7
  • MD5 d947d670aefcb65eed9e9191bb6659b7
  • SHA1 50562d1ed8484b631397db5f37077e67ddfa60e1
  • SHA512 796e1c05b61527839f112712733a76c10e2f6c0d36fa5fbb6d1e24be4f49009caa8de3ecd8c40742613cb5cb3c09a7fe10d6400958bef1d8ed512ed1c7edbb8d
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookratspywarestealersuricatatrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • CustAttr .NET packer

    Detects CustAttr .NET packer in memory.

  • Formbook Payload

    rat

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2