Extracted

• • Target
    PO.doc
  • Size 13KB
  • SHA256 443ffe0efb43ac5c04e23e749b2908a8e723462f409208e0f4cf35046e3b129d
  • MD5 5be61511dab1f4f76366f52ca8fec8b1
  • SHA1 70a6dd35d6da873242e3c56ff86f000c78614a1f
  • SHA512 bd63c51ff9033fd445445dde368b8c2753b82dce3f109125ce7045c67f6834b445e70c23d8c0ab0f6e13bf3588123e22ebbdc6001da8e58e8422188dcb49343e
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookif60ratspywarestealersuricatatrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Formbook Payload

    rat

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2