Extracted

• • Target
    JP181213001.exe
  • Size 248KB
  • SHA256 ff3e94ded64b43f620ba549db99baa31abdd763209b60f7c9fc884b82cfac6d3
  • MD5 2227e82af165e9abd6be3e1f88b87bb5
  • SHA1 18955ce83951ac6545f1119b4db6a05187545f7b
  • SHA512 391f34e1619ecb6990f00d165c5475cacf8f2240dca0c7de35678648c370ba8cd1363b6807cd383589c279af0539ca8d15e4d60aa0394d31646c08ece3cdf09a
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookd1s8ratspywarestealersuricatatrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Formbook Payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2