Extracted

• • Target
    Factura_834.pdf.exe
  • Size 248KB
  • SHA256 945f67ae677681e14db036f753f47333556fea6f3837bef7399e440e6bc167d5
  • MD5 e6829416fc3898252388037593d99d44
  • SHA1 679943b9e71caf6af6d1930b3347dd6478e0d8dd
  • SHA512 267edbff89189222e91238829d32ebfe9316d93c5fabe27fe6a351e7d02ef128065cd564bf8e54022deac8d49d6233b22114e881e828032cbd003910e051b296
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookg12npersistenceratspywarestealersuricatatrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Formbook Payload

    rat

  • Sets service image path in registry

    persistence

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2