Extracted

• • Target

    REQUEST FOR QUOTE.doc

  • Size

    31KB

  • MD5

    d4acf465341a32fb6aa5743a75957148

  • SHA1

    f9e1c6c655fa31e6653997f818a88282e918fb1a

  • SHA256

    f5ec49a46ce3250a7c89ff0c24c2a32645e1a1cf58266252b850e5b675af8b1e

  • SHA512

    805bcc3f9ef890eb03f2a4b5f31477fd39712fe3b9a827d19e08973b82806013c5a1d6d1ba0e083861a5bc6167f6bf49977305c2236cedfbbeb345c4ae8aebb8

  Score

  10^/10

  formbookvngbratspywarestealersuricatatrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Formbook Payload

    rat

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2