Extracted

• • Target
    PAGO.exe
  • Size 867KB
  • SHA256 df8b0772860e56938078f92e437d4c04ff34808f40837e249b85af1ffb4dee4b
  • MD5 3f332ec29d9e058eb1c0e296b04b2518
  • SHA1 aa4d9429a1f410beb085f86fa4a5f516f99f6a8b
  • SHA512 87037bf33969bded6e7e245dfe28edb3f2f1b57ea56b7071957157c2c16fbf4005a68dc198b336c751e346931e479a12f5dc1878b583e4e227a47d93d0700c79
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookm3ucratspywarestealersuricatatrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Formbook Payload

    rat

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2