Extracted

• • Target
    PO.doc
  • Size 19KB
  • SHA256 2dfd64c86cfb81ed8a280b74e6e7b244a8a98d3788c8c552266ddd5327e4f055
  • MD5 601260b52c23f2be80998a22b2fc77dd
  • SHA1 e4fd634040abd4f6b58aa7efe8fb59f7e64a395f
  • SHA512 d8beacb0e01df26d41812d4152ff8afe46c25e620d200af0e9d6a27b6f89cd4dc915d77ca2f4f3e04dc78ff43192a4d5b5e52674eef4a000a0cc35dc4ef0df22
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookif60ratspywarestealersuricatatrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Formbook Payload

    rat

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2