Extracted

• • Target
    Xjnnpfmtmgzsjdtbismbqwngwvhuqbxdfh.exe
  • Size 1.1MB
  • SHA256 2c3d0dfe94f6ee36822a79a0d6bc22efbd964781a984dec679acbb5029ce1493
  • MD5 141d9c1ff226fedde53d68b36ad4d57d
  • SHA1 752f82f39496cf70d5d5cb4f028301c7a1648b30
  • SHA512 7cddfea0c95093a8ee1310869fcb5fd775281a5c897ff260ab78644c8ebb36feca4f117d1c8179ced72fb2b2ab89860d71b39cfed48999c4fd7d237a4cf207b0
  • MD5 SHA1 SHA512

  Score

  10^/10

  persistenceformbook3nopratspywarestealersuricatatrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Formbook Payload

    rat

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2