Extracted

• • Target
    Order_CF00128.exe
  • Size 249KB
  • SHA256 46eb08598db36bbd56aa97a864deb6e81b1a4f335cab69c02a163c7621f1d7e4
  • MD5 3354c90e93804da5b59c5e037bde0e0e
  • SHA1 ed6b364621233b681788f4598ff17268d15c2729
  • SHA512 fb72d0af999edc22712e517fa850f7ef22494734835ae1873abff5610ae890518479232c1cd41365b5fc8f04613b0570d45362e9c1c479e9a1565c38555c5b4f
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookos16ratspywarestealersuricatatrojanpersistence

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Formbook Payload

    rat

  • Sets service image path in registry

    persistence

  • Deletes itself

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2