Extracted

• • Target
    INV-DHL2020386585.exe
  • Size 496KB
  • SHA256 e267c90f997f2006197fa6cfc8c36255fbb2b317fba5fcf161dd18cfb9c0943f
  • MD5 8b07e3763867296efc4b70f74343ba7a
  • SHA1 8c9368e2ff0489d673efddbaed2d59df259d61e9
  • SHA512 0f9730ff9478535a2187866a03081078ac0a48085e6f71e03a7f379ed3e0c3267d08c17f629e7032e6661d0471cffec392b281d10d6420ab4ea6987cefde4183
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookcn31ratspywarestealersuricatatrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Formbook Payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2