Extracted

• • Target
    PFR 2012R2-45137.exe
  • Size 749KB
  • SHA256 6a778cbfb34a637265c39ae5a0a321010998d93fb7183b4e8766a4a2390bf72f
  • MD5 8fa85ce4b25441a6e45dd6c74cb79670
  • SHA1 1b5ce8ebb1074d89dead6ed83e7c8d6d77a8971f
  • SHA512 31c726a677f25ef0dbb688d0b778d527661fda5208da8bd3cb11fc971536b8b2e18ccdeea4008956515a6fd6c1f6d1999884a754e51fc696b5540dbf1c2ec5be
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookergsratspywarestealersuricatatrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Formbook Payload

    rat

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2