Extracted

• • Target
    Ziraat Bankasi Swift Mesaji.exe
  • Size 278KB
  • SHA256 c6cbe14f336bc97cc4bf2db682cc36efc1b371f6cc45509ee347c29348903676
  • MD5 96f1bd6a162b8802877dc41452a43ccf
  • SHA1 a9205fa768cc55a34c22329b9e0199b23604d5a3
  • SHA512 bf416e139b3000e3864287af55fb115ca54070b9ab5b09f3b663cc5604a25eab6eeb35429b6e542b3483f08efa8f2028468a87cba8285c6918568f738a2b91d9
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbooka0p6ratspywarestealersuricatatrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Formbook Payload

    rat

  • Deletes itself

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2