Extracted

• • Target
    Purchase order.exe
  • Size 1.0MB
  • SHA256 d63d548b5dc0b73cec82f7e97e9e296d87c689142c79101d6b2ccf6ea6499db0
  • MD5 18b3d241a01b1dce595a0a6ed965b7bd
  • SHA1 e4fd9d43a9fdb739b747fa02e4ac9c903157a5b5
  • SHA512 9d8cbe9ee258ce7d8a2a5089cb0403dce7cc8bb8217df4870e3a512cf929ffa00dbd58000261e523aeb34ed2870cf24a8b202a9243c92b910bd70a7e67b3ef00
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbooksnr6ratspywarestealersuricatatrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Formbook Payload

    rat

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2