Extracted

• • Target
    Ziraat Bankasi Swift Mesaji.exe
  • Size 460KB
  • SHA256 02a417e5e680719a68ae77c65cb7deb70b85c839484fee128b77cc920674f18b
  • MD5 db19d30085e93639a251f74520987cd4
  • SHA1 dd9a0cbbe3c069d123b9e9916ed682a1dfdf7ade
  • SHA512 4a13e2acf57b097f0eb2dd5282bd0680c4ce9d8cb4fd1433455d7db8c152e708574f6f8ad91fe8a43da5ad33374dbccd20f4789dac391f26c4f3b25fc1c24418
  • MD5 SHA1 SHA512

  Score

  10^/10

  formbookgd08ratspywarestealersuricatatrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata

  • Formbook Payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2