Extracted

• • Target
    ROTONDI-NEW ORDER PT004.exe
  • Size 250KB
  • SHA256 baef60b7ed8a0286e276a7b7d76c7a9d52a8a77c2688b0d2b2cc1d886954b1a0
  • MD5 f536635d5e97e42c2094f8b55a1c6c28
  • SHA1 931da46b998bb65a6a08a01e90d41689653d4103
  • SHA512 07eccfbe1c8a9753eeee8e18b6d3f5de2e41f7c2e01f6da9234aba0b63985b20dac15061cda990023d4f905bbefa309edf192d157d1f19193601b9b7946a80a3
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbooka0p6ratspywarestealersuricatatrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Formbook Payload

    rat

  • Deletes itself

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2