Extracted

• • Target
    rrwq200123.exe
  • Size 253KB
  • SHA256 e5ebc473e259ec57e2a831477b449dd07c13198c0db74ce67732a8fce59e25ac
  • MD5 3a5c5bb43232e4e48b63cdf123dec876
  • SHA1 95b478c57de28b87d6bd87dd32a4faec02b0d620
  • SHA512 59bd907d7faa8aab41c1cfc78d0aabf8592e8e1e8b49abc4340b807718b96d2e281270f15a5767d6df4e4acde5375ed20756c8598019ed927866dc25c70f7281
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookrv9nratspywarestealersuricatatrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Formbook Payload

    rat

  • Deletes itself

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2